CVE-2024-10470: WPLMS Path Traversal Vulnerability

CVE-2024-10470 Overview

CVE-2024-10470 is a critical path traversal vulnerability affecting the WPLMS Learning Management System theme for WordPress. The vulnerability exists due to insufficient file path validation and permissions checks in the readfile and unlink functions, allowing unauthenticated attackers to read and delete arbitrary files on the server. This flaw is particularly dangerous because the theme is vulnerable even when it is not activated, meaning simply having the theme installed on a WordPress site exposes it to attack.

Critical Impact

Unauthenticated attackers can delete critical WordPress configuration files such as wp-config.php, which can lead to remote code execution by triggering WordPress's installation process and allowing attackers to establish their own database connections and credentials.

Affected Products

• Vibethemes WordPress Learning Management System (WPLMS) versions up to and including 4.962
• WordPress sites with WPLMS theme installed (active or inactive)

Discovery Timeline

• 2024-11-09 - CVE CVE-2024-10470 published to NVD
• 2025-12-23 - Last updated in NVD database

Technical Details for CVE-2024-10470

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), representing a failure to properly sanitize user-supplied file paths before passing them to sensitive file system operations. The vulnerable code paths exist within the theme's readfile and unlink function implementations, which accept user input without adequate validation to prevent directory traversal sequences.

The attack requires no authentication, allowing any remote attacker to exploit it directly over the network. The vulnerability affects the confidentiality, integrity, and availability of affected systems. An attacker can read sensitive files containing database credentials, API keys, and other secrets, or delete critical files to destabilize the WordPress installation entirely.

What makes this vulnerability particularly severe is that the theme remains vulnerable even when deactivated. WordPress themes that are installed but not active still have their PHP files accessible, allowing attackers to directly invoke vulnerable endpoints regardless of the theme's activation status.

Root Cause

The root cause is insufficient input validation in file path handling. The readfile and unlink functions fail to properly sanitize user-controlled input, allowing directory traversal sequences (such as ../) to escape the intended directory scope. Additionally, proper permission checks are not enforced before these file operations, allowing unauthenticated users to perform actions that should be restricted to administrators.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests containing directory traversal sequences to target specific files on the server. By targeting wp-config.php for deletion, an attacker can force WordPress into its installation mode, where they can reconfigure the site with attacker-controlled database settings and achieve remote code execution.

The vulnerability can be exploited by sending crafted requests to the WPLMS theme's vulnerable endpoints. The attacker supplies a file path parameter containing traversal sequences like ../../../wp-config.php to navigate outside the intended directory and access or delete arbitrary files on the system. Since no authentication is required, this attack can be automated and performed at scale against vulnerable WordPress installations.

Detection Methods for CVE-2024-10470

Indicators of Compromise

• Unexpected HTTP requests to WPLMS theme endpoints containing directory traversal patterns (../ sequences)
• Missing or modified wp-config.php or other critical WordPress core files
• WordPress entering installation/setup mode unexpectedly
• Web server access logs showing requests with encoded traversal sequences (%2e%2e%2f) targeting the WPLMS theme directory

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block requests containing path traversal patterns targeting WPLMS endpoints
• Monitor file integrity of critical WordPress files including wp-config.php, wp-settings.php, and core directories
• Implement anomaly detection for unusual file system operations initiated through web server processes
• Review web server access logs for suspicious requests to /wp-content/themes/wplms/ paths with traversal characters

Monitoring Recommendations

• Enable detailed access logging on web servers to capture full request URIs and parameters
• Set up real-time alerting for modifications or deletions to WordPress configuration files
• Monitor for WordPress entering installation mode by detecting access to /wp-admin/install.php
• Deploy SentinelOne Singularity Platform to detect and respond to suspicious file system activities on WordPress hosting servers

How to Mitigate CVE-2024-10470

Immediate Actions Required

• Update the WPLMS Learning Management System theme to version 4.963 or later immediately
• If an update is not immediately available, remove or rename the WPLMS theme directory to prevent exploitation
• Review file system integrity to verify wp-config.php and other critical files have not been tampered with
• Check web server access logs for signs of previous exploitation attempts

Patch Information

The vulnerability affects all versions of the WPLMS Learning Management System theme up to and including version 4.962. Site administrators should update to the latest patched version available through ThemeForest. For additional vulnerability details and remediation guidance, refer to the Wordfence Vulnerability Report.

Workarounds

• Remove the WPLMS theme entirely if not in use, as the vulnerability is exploitable even when the theme is inactive
• Implement WAF rules to block requests containing path traversal patterns to the WPLMS theme directory
• Restrict direct access to theme PHP files through web server configuration
• Apply principle of least privilege to web server file system permissions to limit the impact of file deletion attacks

# Example: Block access to WPLMS theme via .htaccess if theme cannot be removed
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^wp-content/themes/wplms/.*\.php$ - [F,L]
</IfModule>