Bootstrap Ultimate <= 1.4.9 - प्रमाणीकृत सीमित स्थानीय फ़ाइल समावेशन (Unauthenticated Limited Local File Inclusion)

The impact of CVE-2024-13545 is severe. An attacker can leverage the LFI vulnerability to include malicious PHP files, effectively gaining control over the web server's execution flow. This could involve uploading a PHP backdoor, reading sensitive configuration files (database credentials, API keys), or even executing arbitrary commands on the server. The possibility of php://filter enabling direct Remote Code Execution (RCE) significantly amplifies the risk, allowing attackers to bypass access controls and compromise the entire WordPress instance. This vulnerability shares similarities with other LFI exploits where attackers leverage file inclusion to gain unauthorized access and execute malicious code.

WordPress websites using the Bootstrap Ultimate theme, particularly those running versions prior to the patch release, are at significant risk. Shared hosting environments are especially vulnerable as they often lack granular access controls, making it easier for attackers to exploit the vulnerability. Websites with legacy configurations or those that haven't implemented robust security practices are also at higher risk.

• wordpress / composer / npm:

grep -r "path=". /var/www/html/wp-content/themes/bootstrap-ultimate/

• generic web:

curl -I 'http://your-wordpress-site.com/wp-content/themes/bootstrap-ultimate/?path=../../../../etc/passwd'

• wordpress / composer / npm:

wp plugin list --status=inactive | grep 'bootstrap-ultimate'

• generic web: Check access logs for requests containing suspicious path parameters like ../ or ../../ targeting the /wp-content/themes/bootstrap-ultimate/ directory. • wordpress / composer / npm: Use a WordPress security plugin to scan for LFI vulnerabilities and potential malicious file inclusions.

1. 2025-01-24Disclosure

   disclosure

1. आरक्षित2025-01-20
2. प्रकाशित2025-01-24
3. संशोधित2025-02-12
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-13545 is to upgrade to a patched version of the Bootstrap Ultimate WordPress theme as soon as it becomes available. In the interim, several workarounds can be implemented. A Web Application Firewall (WAF) can be configured to block requests containing suspicious path parameters. Restrict file upload permissions to prevent attackers from uploading malicious PHP files. Disable the php://filter wrapper if it is not essential for your application. Regularly scan your WordPress installation for vulnerabilities using security plugins. After upgrading, confirm the fix by attempting to access a non-existent file via the vulnerable parameter and verifying that a 404 error is returned.