CVE-2024-56281 describes a PHP Local File Inclusion vulnerability in the codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce plugin (versions <= 5.2.0). The vulnerability arises from improper control over filenames used in include or require statements in PHP code, which can be manipulated to include unintended local files. This can lead to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented.

Successful exploitation of this vulnerability could allow an attacker with low privileges to include and execute arbitrary local files on the server running the affected plugin. This can lead to full compromise of the web application, including disclosure of sensitive data, modification of application behavior, and denial of service. The high CVSS score reflects these severe impacts. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin if possible. Monitoring for updates from the vendor codemstory is recommended to apply any official patches promptly once available.