CVE-2024-10763 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Path Traversal in **Campress** plugin. 📉 **Consequences**: Attackers can **include & execute arbitrary files** on the server. Total compromise risk! 💥

Q: Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-22 (Path Traversal). 🔍 **Flaw**: `campress_woocommerce_get_ajax_products` function fails to **validate input** properly. 🚫

Q: Who is affected? (Versions/Components)

👥 **Affected**: WordPress Plugin **Campress**. 📦 **Version**: **1.35** and earlier. 🏢 **Vendor**: ApusTheme. ⚠️

Q: What can hackers do? (Privileges/Data)

💻 **Privileges**: Server-level access. 📂 **Data**: Arbitrary file execution. 🕵️♂️ Attackers gain **full control** via file inclusion. 🔓

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: **LOW**. 🚫 **Auth**: None required (PR:N). 🌐 **Network**: Remote (AV:N). ⚡ Easy to exploit! 💨

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Exploit**: No public PoC listed in data. 🕵️♀️ **Status**: Theoretically exploitable. 🧪 Check WordFence intel for details. 🔗

Q: How to self-check? (Features/Scanning)

🔍 **Check**: Scan for **Campress** plugin. 📋 **Version**: Verify if **≤ 1.35**. 🛠️ Look for `campress_woocommerce_get_ajax_products` usage. 🧐

Q: Is it fixed officially? (Patch/Mitigation)

🛡️ **Fix**: Update to **latest version**. 🔄 **Mitigation**: Disable plugin if vulnerable. 🚫 **Official**: ApusTheme should patch. 📢

Q: What if no patch? (Workaround)

🚧 **Workaround**: **Deactivate** Campress plugin immediately. 🛑 **Block**: Restrict access to AJAX endpoints. 🧱 Use WAF rules. 🛡️

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. 🚨 CVSS: **9.1** (Critical). ⚡ Remote, No Auth, High Impact. 🏃♂️ Patch NOW! ⏳

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Path Traversal in **Campress** plugin. 📉 **Consequences**: Attackers can **include & execute arbitrary files** on the server. Total compromise risk! 💥

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-22 (Path Traversal). 🔍 **Flaw**: `campress_woocommerce_get_ajax_products` function fails to **validate input** properly. 🚫

Q3Who is affected? (Versions/Components)

👥 **Affected**: WordPress Plugin **Campress**. 📦 **Version**: **1.35** and earlier. 🏢 **Vendor**: ApusTheme. ⚠️

Q4What can hackers do? (Privileges/Data)

💻 **Privileges**: Server-level access. 📂 **Data**: Arbitrary file execution. 🕵️‍♂️ Attackers gain **full control** via file inclusion. 🔓

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: **LOW**. 🚫 **Auth**: None required (PR:N). 🌐 **Network**: Remote (AV:N). ⚡ Easy to exploit! 💨

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Exploit**: No public PoC listed in data. 🕵️‍♀️ **Status**: Theoretically exploitable. 🧪 Check WordFence intel for details. 🔗

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for **Campress** plugin. 📋 **Version**: Verify if **≤ 1.35**. 🛠️ Look for `campress_woocommerce_get_ajax_products` usage. 🧐

Q8Is it fixed officially? (Patch/Mitigation)

🛡️ **Fix**: Update to **latest version**. 🔄 **Mitigation**: Disable plugin if vulnerable. 🚫 **Official**: ApusTheme should patch. 📢

Q9What if no patch? (Workaround)

🚧 **Workaround**: **Deactivate** Campress plugin immediately. 🛑 **Block**: Restrict access to AJAX endpoints. 🧱 Use WAF rules. 🛡️

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. 🚨 CVSS: **9.1** (Critical). ⚡ Remote, No Auth, High Impact. 🏃‍♂️ Patch NOW! ⏳

Continue exploring

Vulnerability detail Full AI analysis (login) ApusTheme CWE-22