CVE-2024-47323: Path Traversal in WP Timeline Plugin

The core impact of this vulnerability lies in its potential for Remote Code Execution (RCE). By exploiting the Path Traversal flaw, an attacker can manipulate the application to include and execute malicious PHP code from locations outside the intended directory. This could allow them to gain control of the WordPress server, steal sensitive data (user credentials, database information, configuration files), modify website content, or install malware. The blast radius extends to any data accessible by the WordPress application, and depending on server configuration, could potentially allow for lateral movement to other systems on the network.

1. Reserved2024-09-24
2. Published2024-10-05
3. Modified2024-10-07
4. EPSS updated2026-04-02

The primary mitigation is to immediately upgrade the WP Timeline plugin to version 3.6.8 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These include restricting file access permissions within the WordPress directory to prevent unauthorized file inclusions. Implement strict input validation and sanitization to prevent attackers from manipulating file paths. Monitor WordPress access logs and PHP error logs for suspicious file inclusion attempts. Consider using a Web Application Firewall (WAF) with rules to block attempts to access files outside of the intended directories. After upgrading, confirm the fix by attempting a path traversal attack and verifying that the application correctly restricts access.