CVE-2024-10763

CRITICAL 9.8CVE-2024-10763 · Published 13/02/2025 · updated 17/06/2026

In short

CVE-2024-10763 is a CRITICAL (CVSS 9.8) vulnerability affecting campress (apuswp).
Chance of exploitation in the next 30 days (EPSS): 3.7%, higher than 89.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
campress apuswp	`≤ 1.35`	No fix yet

Description

The Campress theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.35 via the 'campress_woocommerce_get_ajax_products' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.

References

themeforest.net/item/campress-responsive-education-courses-and-events-wordpress-theme/19355619 · Product
wordfence.com/threat-intel/vulnerabilities/id/d818b467-a893-4f4f-b623-abff99ef37b4 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free