WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerability

The core of this vulnerability lies in the improper handling of file paths within the WP Timeline plugin. An attacker can craft malicious requests that manipulate the pathname, bypassing intended restrictions and accessing files outside the designated directory. Successful exploitation could allow an attacker to include sensitive configuration files, source code, or even system binaries, leading to information disclosure, denial of service, or, most critically, remote code execution. This could grant the attacker complete control over the affected WordPress instance, enabling them to modify content, install malware, or compromise user data. The potential impact is significant, especially for sites relying on the plugin for critical timeline functionality.

Websites using the WP Timeline plugin, particularly those running older, unpatched versions (≤3.6.7), are at significant risk. Shared hosting environments are especially vulnerable, as they often lack granular control over file permissions and security configurations. Sites with weak WordPress security practices, such as default user credentials or outdated plugins, are also more susceptible to exploitation.

• wordpress / composer / npm:

grep -r "../" /var/www/html/wp-content/plugins/wp-timeline/

• wordpress / composer / npm:

wp plugin list --status=inactive | grep timeline

• wordpress / composer / npm:

find /var/www/html/wp-content/plugins/wp-timeline/ -name '*.php' -print0 | xargs -0 grep -i 'include($_GET['file']);'

1. 2024-10-05Disclosure

   disclosure

1. Reserviert2024-09-24
2. Veröffentlicht2024-10-05
3. Geändert2024-10-07
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-47323 is to immediately upgrade the WP Timeline plugin to version 3.6.8 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent exploitation. While a direct WAF rule is difficult to implement due to the nature of path traversal, careful review of file access patterns and restrictions within the plugin’s code can help identify potential attack vectors. Monitor WordPress access logs for unusual file access attempts, particularly those involving relative paths or directory traversal sequences (e.g., '../').