CVE-2024-10585: InfiniteWP Client Path Traversal Flaw

CVE-2024-10585 Overview

CVE-2024-10585 is a path traversal vulnerability [CWE-22] in the InfiniteWP Client plugin for WordPress. The flaw affects all versions of the plugin up to and including 1.13.0. It resides in the historyID parameter processed by ~/debug-chart/index.php. Unauthenticated attackers can abuse the parameter to read .txt files located outside the intended directory. Successful exploitation exposes limited file content on the underlying server, but does not compromise integrity or availability. The vulnerability is remotely reachable over the network and requires no user interaction or privileges.

Critical Impact
Unauthenticated remote attackers can read arbitrary .txt files outside the plugin's intended directory on affected WordPress installations.

Affected Products

Revmakx InfiniteWP Client plugin for WordPress, all versions up to and including 1.13.0
WordPress sites with the InfiniteWP Client plugin installed and activated
Any hosting environment where the plugin's debug-chart/index.php endpoint is reachable

Discovery Timeline

2025-01-08 - CVE-2024-10585 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-10585

Vulnerability Analysis

The vulnerability exists in the debugging component of the InfiniteWP Client plugin. Specifically, the historyID request parameter passed to debug-chart/index.php is used to construct a filesystem path without sufficient normalization or restriction. Attackers can supply directory traversal sequences to escape the intended directory and read .txt files elsewhere on the server. The endpoint does not require authentication, so the attack can be performed against any exposed WordPress site running a vulnerable plugin version. Impact is bounded by the plugin's file extension handling, which limits disclosure to files ending in .txt. Sensitive information such as debug logs, configuration exports, or credential dumps stored as text files can still be exposed. Details of the fix appear in the WordPress Changeset Update.

Root Cause

The plugin fails to sanitize the historyID parameter before using it in a file read operation. Traversal sequences such as ../ are not stripped or rejected, allowing paths to resolve outside the intended base directory.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the debug-chart/index.php endpoint with a malicious historyID value. The server processes the traversal sequence and returns the contents of a targeted .txt file outside the plugin directory. No credentials, tokens, or user interaction are required. See the Wordfence Vulnerability Report for additional analysis.

No verified proof-of-concept code is publicly cataloged for this CVE; the vulnerability mechanism is described in prose above rather than with synthetic exploit code.

Detection Methods for CVE-2024-10585

Indicators of Compromise

HTTP requests to /wp-content/plugins/iwp-client/debug-chart/index.php containing historyID values with ../ or URL-encoded traversal sequences such as %2e%2e%2f
Web server access logs showing repeated GET or POST requests to the debug-chart/index.php endpoint from a single external source
Responses from the endpoint returning content resembling system or application .txt files

Detection Strategies

Inspect WordPress access logs for anomalous parameter values on the InfiniteWP Client plugin endpoints, focusing on historyID
Deploy Web Application Firewall (WAF) rules that block directory traversal patterns in request parameters targeting /wp-content/plugins/iwp-client/
Correlate unauthenticated requests to plugin debug endpoints with subsequent responses containing file-like content to surface probing behavior

Monitoring Recommendations

Enable verbose HTTP request logging on WordPress hosts running the InfiniteWP Client plugin and forward logs to a centralized analytics platform
Alert on any external access to debug-chart/index.php, as this endpoint is intended for internal debugging use
Track outbound response sizes from the affected endpoint to identify successful file reads

How to Mitigate CVE-2024-10585

Immediate Actions Required

Update the InfiniteWP Client plugin to a version newer than 1.13.0 that contains the fix committed in changeset 3202851
If patching is not immediately possible, deactivate and remove the InfiniteWP Client plugin from affected WordPress installations
Audit web server logs for prior exploitation attempts against the debug-chart/index.php endpoint

Patch Information

Revmakx addressed the path traversal in a WordPress plugin repository update. The fix modifies debug-chart/index.php to validate the historyID parameter and restrict file access to the intended directory. Administrators should apply the update through the WordPress plugin update interface or via WP-CLI. Details are documented in the WordPress Changeset Update.

Workarounds

Block external HTTP access to /wp-content/plugins/iwp-client/debug-chart/index.php at the web server or WAF layer
Add server-level rules to reject requests containing ../, ..\, or URL-encoded traversal sequences in query parameters targeting the plugin path
Restrict filesystem permissions so the WordPress process account cannot read sensitive .txt files outside the web root

bash

# Example nginx location block to deny external access to the vulnerable endpoint
location ~* /wp-content/plugins/iwp-client/debug-chart/index\.php$ {
    deny all;
    return 403;
}