CVE-2024-34554: Path Traversal in Stockholm Core

The core impact of this vulnerability lies in the ability to perform Local File Inclusion (LFI). An attacker could leverage this to read sensitive configuration files, source code, or even system files accessible to the webserver user. Successful exploitation could lead to the disclosure of database credentials, API keys, or other confidential information. While direct remote code execution might not be immediately possible, the ability to read arbitrary files significantly expands the attack surface and could be a stepping stone for further exploitation, such as leveraging a vulnerable application to execute malicious code.

1. Reserved2024-05-06
2. Published2024-06-04
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-34554 is to immediately upgrade the Stockholm Core plugin to version 2.4.2 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../). Additionally, restrict file permissions on sensitive files to the webserver user to limit the potential damage from a successful exploit. Monitor WordPress access logs for suspicious requests containing path traversal attempts.