CVE-2024-9193 is a Local File Inclusion vulnerability in the WHMpress - WHMCS WordPress Integration Plugin affecting all versions up to 6.3-revision-0. The flaw exists in the whmpress_domain_search_ajax_extended_results() function, which improperly controls file inclusion, allowing unauthenticated attackers to include and execute arbitrary files on the server. This can lead to remote code execution and unauthorized administrative access by manipulating WordPress options, including changing the default registration role to administrator and enabling user registration. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The CVSS v3.1 base score is 9.8, reflecting its critical impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported, and no patch or remediation details are currently available.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the affected server, bypass access controls, and modify WordPress configuration options. This includes changing the default user role to administrator and enabling user registration, which can result in full administrative compromise of the WordPress site. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to vulnerable endpoints if possible and monitor for suspicious activity related to file inclusion attempts. Avoid using the affected plugin versions and consider disabling or removing the plugin if immediate patching is not feasible.