CVE-2024-6228: Unknown Notifications For Forms & WordPress Actions

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.

Affected products

• Unknown Notifications For Forms & WordPress Actions: before 2.6 (fixed in 2.6)

Published 2026-07-06. Last modified 2026-07-06.