BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal

The primary impact of CVE-2024-10011 is the potential for unauthorized file access and manipulation. An attacker, having Subscriber-level access or greater within a WordPress site using BuddyPress, can exploit the id parameter to traverse directories and access sensitive files. This could include configuration files, source code, or even system files, depending on server permissions. The ability to upload files outside the web root presents a significant risk, as attackers could potentially place malicious code or files in locations that are not normally accessible, but could still be executed by the server. The vulnerability is limited to Windows environments, which may reduce the overall attack surface but still poses a serious threat to Windows-based WordPress deployments.

WordPress websites utilizing the BuddyPress plugin, particularly those running on Windows servers, are at risk. Shared hosting environments where users have Subscriber-level access or higher are also particularly vulnerable, as attackers can leverage this privilege to exploit the flaw. Legacy WordPress installations with outdated BuddyPress versions are also at increased risk.

• wordpress / composer / npm:

grep -r 'id=../' /var/www/html/wp-content/plugins/buddypress/*

• generic web:

curl -I 'http://your-wordpress-site.com/wp-content/plugins/buddypress/?id=../etc/passwd' # Check for file disclosure

1. 2024-10-25Disclosure

   disclosure

Aktive Installationen

100KBeliebt

Plugin-Bewertung

4.1

Erfordert WordPress

6.1+

Kompatibel bis

6.8.5

Erfordert PHP

5.6+

1. Reserviert2024-10-15
2. Veröffentlicht2024-10-25
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-10011 is to upgrade BuddyPress to a patched version. The vendor has not released a specific fixed version in the provided data, so monitor the official BuddyPress website and WordPress plugin repository for updates. As an interim measure, implement a Web Application Firewall (WAF) rule to block requests containing suspicious directory traversal patterns in the id parameter. Specifically, look for sequences like ../ or absolute paths. Additionally, review file permissions on the server to ensure that the BuddyPress plugin directory and its contents have the minimum necessary permissions. After upgrading, confirm the fix by attempting to access files outside the intended directory using a test account with Subscriber-level access.