CVE-2024-47645: Path Traversal in Top Bar – PopUps

The primary impact of this vulnerability is the potential for Local File Inclusion (LFI). An attacker could exploit this flaw to read sensitive files from the server's file system, such as configuration files containing database credentials, application source code, or even system files. Successful exploitation could lead to unauthorized access to data, compromise of the WordPress installation, and potentially even complete server takeover. The attacker would need to craft a malicious URL that manipulates the file path to include files outside the intended directory. This vulnerability shares similarities with other path traversal exploits, where attackers leverage predictable file system structures to gain unauthorized access.

1. Reserved2024-09-30
2. Published2024-10-16
3. EPSS updated2026-04-02

The most effective mitigation is to immediately upgrade the Top Bar – PopUps plugin to version 2.0.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict file access permissions on the WordPress server to minimize the potential damage from a successful exploit. Implement a Web Application Firewall (WAF) with rules to block requests containing suspicious path traversal patterns, such as double dots (..) or absolute paths. Regularly monitor server logs for unusual file access attempts or errors related to file inclusion.