CVE-2024-5574 is a Local File Inclusion (LFI) vulnerability in the WP Magazine Modules Lite WordPress plugin, affecting all versions up to 1.1.2. The flaw exists in the handling of the 'blockLayout' parameter, which allows authenticated users with Contributor-level privileges or higher to include arbitrary files on the server. This can lead to execution of arbitrary PHP code, enabling attackers to bypass access controls, access sensitive information, or achieve remote code execution. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement). The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and high attack complexity. No patch or official fix has been published, and no exploits are known in the wild.

Successful exploitation allows an authenticated attacker with Contributor-level access or higher to include and execute arbitrary files on the server. This can result in remote code execution, bypassing of access controls, and disclosure of sensitive data. The vulnerability affects confidentiality, integrity, and availability of the affected system. The CVSS score of 7.5 indicates a high severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Monitor for plugin updates from codevibrant and apply any released patches promptly. Consider disabling or removing the WP Magazine Modules Lite plugin if it is not essential.