CVE-2024-5577 is a critical Remote File Inclusion vulnerability in the 'Where I Was, Where I Will Be' WordPress plugin (version ≤ 1.1.1). It arises from improper control of the filename used in an include/require statement in the /system/include/include_user.php file, specifically via the WIW_HEADER parameter. If the PHP setting allow_url_include is enabled, an unauthenticated attacker can supply a remote URL to include arbitrary PHP code, leading to remote code execution, access control bypass, and data disclosure. The vulnerability is classified under CWE-98 and has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No patch or official remediation has been disclosed yet, and the plugin is not a cloud service.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the affected server, potentially leading to full system compromise, bypass of access controls, and disclosure of sensitive information. The impact is rated critical with high confidentiality, integrity, and availability consequences. Exploitation requires the PHP allow_url_include directive to be enabled, which is uncommon by default.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should verify that the PHP configuration directive allow_url_include is disabled (which is the default and recommended setting) to prevent exploitation. Additionally, consider disabling or removing the vulnerable plugin if it is not essential. Monitor official vendor channels for updates or patches addressing this vulnerability.