The vulnerability CVE-2024-48029 affects the SB Random Posts Widget by Hung Trang Si, allowing an attacker to manipulate the filename parameter used in PHP include or require statements. This improper control can lead to Local File Inclusion (LFI), which may allow an attacker to read sensitive files or execute arbitrary code depending on the environment. The affected versions include all up to and including 1.0. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, unauthorized code execution, and potentially full system compromise. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the SB Random Posts Widget if possible. Avoid exposing the vulnerable component to untrusted networks or users. Monitor official channels for updates or patches from Hung Trang Si.