CVE-2024-12811 | ShineTheme Travel Booking WordPress Theme up to 3.1.8 on WordPress Shortcode hotel_alone_slider style filename control

A vulnerability was found in ShineTheme Travel Booking WordPress Theme up to 3.1.8 on WordPress. It has been classified as critical. This affects the function hotel_alone_slider of the component Shortcode Handler. The manipulation of the argument style leads to improper control of filename for include/require statement in php program (‘php remote file inclusion’).

This vulnerability is uniquely identified as CVE-2024-12811. It is possible to initiate the attack remotely. There is no exploit available.

It is recommended to upgrade the affected component.