CVE-2024-6228

highCVSS 7.5covered by 1 sourcefirst seen 2026-07-06

The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.

⚡ Watch CVE-2024-6228

Get an email if CVE-2024-6228 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2024-6228: The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a…nvd · 2026-07-06

External references

NVD record for CVE-2024-6228

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2024-6228 status](https://www.csirts.com/badge/CVE-2024-6228)](https://www.csirts.com/cve/CVE-2024-6228)