Platform
wordpress
Component
wp-cafe
Fixed in
2.2.29
CVE-2024-43135 describes a Path Traversal vulnerability discovered in the WPCafe WordPress plugin. This flaw allows an attacker to include arbitrary files on the server, potentially leading to sensitive data exposure or remote code execution. The vulnerability impacts versions of WPCafe up to and including 2.2.28, and a patch is available in version 2.2.29.
The core impact of this vulnerability lies in its ability to facilitate PHP Local File Inclusion (LFI). An attacker could leverage this to read sensitive files from the server's filesystem, such as configuration files containing database credentials or application source code. More critically, if the attacker can inject and execute arbitrary PHP code through the LFI, they could gain complete control over the affected WordPress site. This could involve defacing the website, installing malware, or stealing user data. The blast radius extends to all users of the vulnerable WPCafe plugin, particularly those with insufficient file permissions or inadequate security configurations.
CVE-2024-43135 was publicly disclosed on August 13, 2024. There are currently no known public exploits or active campaigns targeting this vulnerability. The vulnerability is not listed on the CISA KEV catalog at the time of writing. The relatively straightforward nature of Path Traversal vulnerabilities suggests that a public proof-of-concept may emerge in the near future.
Exploit Status
EPSS
1.66% (82% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-43135 is to immediately upgrade the WPCafe plugin to version 2.2.29 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. Restrict file upload permissions to the WordPress installation directory. Implement a Web Application Firewall (WAF) with rules to block attempts to access files outside of the intended directory structure. Carefully review and harden file permissions on the WordPress server to limit the potential impact of a successful exploit. After upgrading, confirm the vulnerability is resolved by attempting to access a non-existent file via the vulnerable endpoint and verifying that access is denied.
Actualiza el plugin WPCafe a la última versión disponible. Si no hay una versión más reciente, considera deshabilitar o eliminar el plugin hasta que se publique una actualización que corrija la vulnerabilidad. Revisa las notas de la versión para confirmar que la vulnerabilidad ha sido solucionada.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-43135 is a Path Traversal vulnerability affecting the WPCafe WordPress plugin, allowing attackers to potentially include arbitrary files on the server.
You are affected if you are using WPCafe version 2.2.28 or earlier. Upgrade to version 2.2.29 to resolve the issue.
Upgrade the WPCafe plugin to version 2.2.29 or later. Consider temporary workarounds like WAF rules and file permission restrictions if immediate upgrade is not possible.
As of August 2024, there are no confirmed reports of active exploitation, but the vulnerability's nature suggests potential for future exploitation.
Refer to the official WPCafe plugin website or WordPress plugin repository for the latest advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.