The vulnerability CVE-2024-52449 affects Navneil Naicer Bootscraper versions up to 2.1.0. It is caused by improper limitation of a pathname to a restricted directory, enabling path traversal attacks that lead to PHP local file inclusion. This can allow an attacker to include arbitrary files on the server, potentially resulting in full system compromise. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and user interaction required.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, modification of application data, and disruption of service. The attacker can execute arbitrary PHP code by including local files, which may result in complete system compromise. The vulnerability affects all Bootscraper versions up to and including 2.1.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable Bootscraper plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.