Platform
wordpress
Component
timeline-and-history-slider
Fixed in
2.3.1
CVE-2024-43232 describes a Path Traversal vulnerability within the Timeline and History slider component of WP OnlineSupport. This flaw allows attackers to potentially include arbitrary files on the server, leading to sensitive data exposure or even remote code execution. The vulnerability impacts versions of the plugin up to and including 2.3. A patch has been released in version 2.3.1.
The core impact of this vulnerability lies in its ability to facilitate PHP Local File Inclusion (LFI). An attacker can leverage this Path Traversal flaw to manipulate file paths, tricking the application into including files from outside the intended directory. This could allow them to read sensitive configuration files, source code, or even execute arbitrary PHP code on the server. Successful exploitation could lead to complete compromise of the WordPress site, including data theft, defacement, and the installation of malware. The potential for code execution significantly elevates the risk, allowing attackers to gain persistent access and control over the affected system.
CVE-2024-43232 was publicly disclosed on August 19, 2024. While no public proof-of-concept (PoC) code has been widely reported, the Path Traversal nature of the vulnerability makes it relatively straightforward to exploit. The vulnerability is not currently listed on the CISA KEV catalog. Active exploitation is possible given the ease of exploitation and the widespread use of WordPress plugins.
Exploit Status
EPSS
0.77% (73% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-43232 is to immediately upgrade the WP OnlineSupport Timeline and History slider plugin to version 2.3.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting file access permissions on the server. Implement a Web Application Firewall (WAF) rule to block requests containing path traversal attempts (e.g., ../ sequences). Regularly review and audit the plugin's code for any further vulnerabilities. After upgrading, confirm the fix by attempting a path traversal attack and verifying that it is blocked.
Update the Timeline and History slider plugin to the latest available version. The Local File Inclusion vulnerability allows attackers to access sensitive server files. The update fixes this vulnerability.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-43232 is a Path Traversal vulnerability in the WP OnlineSupport Timeline and History slider plugin, allowing attackers to potentially include arbitrary files on the server.
You are affected if you are using WP OnlineSupport Timeline and History slider version 2.3 or earlier. Upgrade to 2.3.1 to resolve the issue.
Upgrade the WP OnlineSupport Timeline and History slider plugin to version 2.3.1 or later. Consider temporary workarounds like WAF rules if immediate upgrade is not possible.
While no confirmed active exploitation has been publicly reported, the vulnerability's ease of exploitation suggests it is a potential target for attackers.
Refer to the WP OnlineSupport website or WordPress plugin repository for the official advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.