CVE-2024-43345: Path Traversal in Landing Page Builder

The core impact of CVE-2024-43345 stems from the Path Traversal flaw. An attacker can manipulate file paths to access files outside the intended directory, specifically enabling Local File Inclusion (LFI). This means an attacker could potentially read configuration files, source code, or other sensitive data stored on the server. In a worst-case scenario, if the server allows PHP to execute files from arbitrary locations, this could lead to Remote Code Execution (RCE), granting the attacker complete control over the affected WordPress instance. The blast radius extends to any data accessible via the server's file system.

1. Reserved2024-08-09
2. Published2024-08-19
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-43345 is to immediately upgrade the Landing Page Builder plugin to version 1.5.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These could include restricting file access permissions on the server to limit the potential damage from a successful exploit. Web Application Firewall (WAF) rules can be configured to block requests containing suspicious path traversal patterns (e.g., '../'). After upgrading, verify the fix by attempting to access files outside the intended directory via the plugin's interface; access should be denied.

Active installs

10KKnown

Plugin rating