CVE-2024-9193 is a critical (CVSS 9.8) local file inclusion in the WHMpress WHMCS WordPress Integration plugin, in all versions up to and including 6.3-revision-0. Unauthenticated attackers can include and run files, and the record describes a path to a new administrator. Update to a fixed release from the vendor.
What's affected
The record covers the WHMpress WHMCS WordPress Integration plugin, all versions up to and including 6.3-revision-0. The vulnerable function is whmpress_domain_search_ajax_extended_results(), which includes a file based on request input without enough checks.
The description adds a second step. It says the weakness makes it possible for unauthenticated attackers to update arbitrary options on the site, and that by using the plugin's /admin/services.php file, the default role for registration could be changed to administrator and user registration enabled, giving an attacker an administrator account.
The references are the WHMpress change log and a Wordfence entry. We could not read either automatically, so the first fixed version is not confirmed here. Open the change log to find the release after 6.3-revision-0.
How to check if you're exposed
Check the plugin version on each WordPress site.
wp plugin list
Look for the WHMpress plugin in the list and read its version. In the admin dashboard the same information is on the Plugins page.
Because the described outcome includes changing site options, also check the signs of misuse.
- Go to Settings, General, and check that New User Default Role is not set to Administrator and that Anyone can register is off unless you want it on.
- Review the Users list for administrator accounts you do not recognize, sorted by registration date.
- Review web server logs for repeated requests to the plugin's AJAX handler for domain search results.
What to do now
- Find WordPress sites that use the WHMpress WHMCS plugin.
- Update to a release after 6.3-revision-0, checking the vendor change log.
- Check the default registration role and the open registration setting.
- Remove unknown administrator accounts and reset all administrator passwords.
- Restore from a clean backup if you find signs of compromise.
- Consider a web application firewall that blocks file inclusion attempts.
Why it matters
Local file inclusion means that the server includes a file from its own disk based on input that the user can influence. If the code runs the included file as PHP, then any file an attacker can place or find becomes executable code. The class is improper control of the filename for include in PHP programs.
The record is also a good example of how a file inclusion bug can turn into account takeover without any upload. Changing one option, the default registration role, is enough to hand out administrator accounts. After an incident like this, audit site settings and user accounts as well as files.
The weakness class is CWE-98: Improper Control of Filename for Include or Require in PHP. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
How can this lead to a new admin account?
The record describes using the bug to update site options so that new registrations receive the administrator role.
Where is the fix?
Check the vendor change log for a release after 6.3-revision-0.
Sources
Last reviewed: 19 October 2026.
