{"id":"CVE-2024-3673","aliases":["EUVD-2024-32248","GHSA-8pqc-xcjc-j8v3"],"status":"published","title":"Web Directory Free \u003c 1.7.3 - Unauthenticated LFI","description":"The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.05578,"percentile":0.92937,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2024-08-30T06:00:02Z","modified":"2026-06-17T07:44:47Z","exploits":[{"source":"nuclei","id":"CVE-2024-3673","title":"Web Directory Free \u003c 1.7.3 - Local File Inclusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-3673.yaml"},{"source":"pocgithub","id":"Nxploited/CVE-2024-3673","title":"Nxploited/CVE-2024-3673","date":"2025-01-24","url":"https://github.com/Nxploited/CVE-2024-3673"}],"products":[{"vendor":"salephpscripts","product":"web_directory_free"},{"vendor":"shamalli","product":"web directory free"},{"vendor":"unknown","product":"web directory free"}],"references":[{"url":"https://wpscan.com/vulnerability/0e8930cb-e176-4406-a43f-a6032471debf/","tags":["exploit","vdb-entry","technical-description","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3673"},{"url":"https://wpscan.com/vulnerability/0e8930cb-e176-4406-a43f-a6032471debf"},{"url":"https://github.com/advisories/GHSA-8pqc-xcjc-j8v3"}],"sources":{"cve":[{"id":"CVE-2024-3673","title":"Web Directory Free \u003c 1.7.3 - Unauthenticated LFI","description":"The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.","status":"published","published":"2024-08-30T06:00:02.162Z","modified":"2024-08-30T18:16:23.243Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:34:10.961618Z"}],"euvd":[{"id":"EUVD-2024-32248","description":"The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.","status":"published","published":"2024-08-30T06:00:02Z","modified":"2024-08-30T18:16:23Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T00:56:06.59198Z"}],"ghsa":[{"id":"GHSA-8pqc-xcjc-j8v3","title":"The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using...","description":"The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.","status":"published","published":"2024-08-30T06:30:38Z","modified":"2024-08-30T21:32:42Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T14:58:09.209202Z"}],"nvd":[{"id":"CVE-2024-3673","description":"The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.","status":"published","published":"2024-08-30T06:15:05.4Z","modified":"2026-06-17T07:44:47.2Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:10:21.771404Z"}]}}