CVE-2024-8392 is a Local File Inclusion vulnerability (CWE-98) in the WordPress Post Grid Layouts with Pagination – Sogrid plugin affecting all versions up to 1.5.6. The vulnerability arises from improper control of the filename used in an include/require statement via the 'tab' parameter. Authenticated attackers with Administrator privileges can exploit this to include arbitrary files, enabling execution of PHP code on the server. This can bypass access controls and lead to disclosure of sensitive information or remote code execution. The vulnerability can also be exploited using CSRF attacks. The CVSS v3.1 score is 7.2 (High severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with Administrator-level access to execute arbitrary PHP code on the server by including files via the vulnerable 'tab' parameter. This can lead to bypassing access controls, unauthorized data access, and full system compromise. The vulnerability also supports exploitation through CSRF, increasing the attack surface. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the plugin. Consider disabling or removing the plugin if it is not essential. Implementing CSRF protections and limiting file upload capabilities may reduce risk but do not fully mitigate the vulnerability.