CVE-2024-8252 is a Local File Inclusion vulnerability (CWE-98) in the Clean Login plugin for WordPress, affecting all versions up to 1.14.5. The flaw arises from improper control of the filename used in an include/require statement via the 'template' attribute in the clean-login-register shortcode. Authenticated attackers with at least Contributor privileges can exploit this to include arbitrary files, including those uploaded as images or other file types, enabling execution of arbitrary PHP code on the server. This can result in bypassing access controls, unauthorized data access, and remote code execution. The CVSS 3.1 base score is 8.8 (High), reflecting network attack vector, low complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently referenced.

Successful exploitation allows authenticated users with Contributor-level access or higher to execute arbitrary PHP code on the server by including arbitrary files. This can lead to bypassing access controls, unauthorized disclosure of sensitive information, and full system compromise. The vulnerability affects confidentiality, integrity, and availability of the affected system, as reflected by the CVSS score of 8.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Clean Login plugin if possible. Monitor for updates from the vendor or security advisories to apply patches promptly once released.