CVE-2024-10470: Arbitrary File Access in WPLMS LMS

The primary impact of CVE-2024-10470 is the ability for an attacker to read and delete arbitrary files on a WordPress server. This is particularly concerning because deleting critical files like wp-config.php can lead to remote code execution. Successful exploitation allows an attacker to gain control of the web server, potentially leading to data breaches, website defacement, and further compromise of the underlying system. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of threat actors. The fact that the theme remains vulnerable even when inactive amplifies the risk, as it can be exploited regardless of the active theme.

1. Reserved2024-10-28
2. Published2024-11-09
3. Modified2024-11-12
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-10470 is to upgrade WPLMS to a version that addresses the vulnerability. Unfortunately, a specific fixed version is not provided in the input. As a temporary workaround, restrict file permissions on the WPLMS directory to prevent unauthorized access and deletion. Implement a Web Application Firewall (WAF) with rules to block attempts to access or manipulate files outside of designated directories. Regularly monitor server logs for suspicious file access or deletion attempts. After upgrading, confirm the fix by attempting to access sensitive files via the vulnerable endpoint and verifying that access is denied.