CVE-2024-8393 is a Local File Inclusion vulnerability in the Woocommerce Blocks – Woolook plugin for WordPress, affecting all versions up to and including 1.7.0. The vulnerability arises from improper control of the filename used in an include/require statement, specifically via the 'tab' parameter. This flaw allows authenticated administrators to include arbitrary files on the server, enabling execution of PHP code contained within those files. The vulnerability can be exploited without user interaction via CSRF. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary PHP code on the server, potentially bypassing access controls and accessing sensitive data. The vulnerability also enables code execution through inclusion of attacker-controlled files, which can compromise the integrity and availability of the affected system. The ability to exploit via CSRF increases the attack surface by allowing exploitation without direct user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity. Consider disabling or removing the vulnerable plugin if feasible. Implementing CSRF protections may reduce risk but does not fully mitigate the vulnerability.