CVE-2024-0844 is a medium severity (CVSS 4.7) local file inclusion in the Popup More Popups, Lightboxes, and more plugin for WordPress, version 2.1.6, through ycfChangeElementData(). Administrators can include files ending with Form.php. Update to a release later than 2.1.6.
What's affected
The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress, version 2.1.6. The record says the ycfChangeElementData() function allows authenticated users with administrator access and above to include and execute arbitrary files ending with Form.php on the server.
The record notes this could bypass access controls, expose data or lead to code execution where images and other safe file types can be uploaded and included. No fixed version is named.
The record classifies the weakness as CWE-22 (path traversal). NVD scores it 4.7 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L.
How to check if you're exposed
Plugins are the usual blind spot on a WordPress estate, so start with an inventory. If you have shell access and WP-CLI, this lists every plugin with its version and status:
wp plugin list --fields=name,status,version,update
Look for Popup More in the output and compare the version to the range above. Without WP-CLI, open Plugins in the dashboard and read the version under the plugin name. Do this on every site, including staging copies and old multisite installs, because inactive plugins still sit on disk and some can be reached directly by URL.
The free in-browser dependency scan covers application dependencies in your repositories. It does not read a live WordPress install, so use the plugin list for this one.
What to do now
- Update the plugin to a version later than 2.1.6, or remove it.
- Reduce the number of administrator accounts and require strong authentication for them.
- Review upload settings to see which file types can be stored on the server.
- Check the plugin directory for unexpected files.
Why it matters
Path traversal (CWE-22) here shows up as file inclusion: a name controlled by the caller picks which server side file runs. The requirement for administrator access keeps the score in the medium range.
On a site with many administrators, or where an admin account is stolen, the flaw adds a path from admin access to server code execution.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Why does an admin only bug matter?
Admin accounts get phished and reused. A bug that turns admin into code execution raises the cost of that single compromise.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
