The vulnerability CVE-2024-44048 exists in the wpWax Product Carousel Slider & Grid Ultimate for WooCommerce plugin, versions up to 1.9.10. It is caused by improper control of the filename parameter in PHP include or require statements, enabling remote file inclusion. This can be exploited remotely over the network by an attacker with low privileges without user interaction. The CVSS 3.1 base score is 6.5, reflecting a medium severity with high confidentiality impact but no impact on integrity or availability.

Successful exploitation of this vulnerability could allow an attacker to include and execute remote PHP files, potentially leading to unauthorized disclosure of sensitive information. The CVSS score indicates a high confidentiality impact but no direct impact on integrity or availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity related to file inclusion attempts. Avoid using untrusted input in include/require statements in customizations.