CVE-2024-10804: WordPress Video Player Path Traversal

CVE-2024-10804 Overview

CVE-2024-10804 is a directory traversal vulnerability [CWE-22] affecting the Ultimate Video Player WordPress & WooCommerce Plugin. The flaw exists in the content/downloader.php file and impacts all versions up to and including 10.0. Unauthenticated attackers can exploit the issue over the network to read arbitrary files on the underlying server. Disclosed files can include WordPress configuration data, credentials, and other sensitive content stored on the host.

Critical Impact
Unauthenticated remote attackers can read arbitrary files on the server, exposing wp-config.php, database credentials, and other sensitive data.

Affected Products

Ultimate Video Player WordPress & WooCommerce Plugin (all versions through 10.0)
WordPress sites with the plugin installed and active
WooCommerce deployments bundling the affected plugin

Discovery Timeline

2025-03-07 - CVE-2024-10804 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10804

Vulnerability Analysis

The vulnerability resides in the content/downloader.php script bundled with the plugin. The script accepts a user-supplied file parameter and passes it to file read operations without sufficient path sanitization. Attackers can supply traversal sequences such as ../ to escape the intended directory and reach arbitrary file paths on the server filesystem.

Because the endpoint does not require authentication, exploitation requires no credentials, no user interaction, and no prior foothold. The impact is limited to confidentiality, with no integrity or availability effects per the published vector. Successful exploitation discloses files readable by the web server process, which on typical LAMP stacks includes wp-config.php, log files, and system configuration files such as /etc/passwd.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The downloader.php handler does not validate or normalize the requested file path before reading and returning its contents. Missing checks for path traversal sequences and absence of an allowlist of permitted files allow attackers to traverse outside the plugin directory.

Attack Vector

Exploitation occurs over HTTP or HTTPS by sending a crafted request to the plugin's downloader.php endpoint. The attacker supplies a file path parameter containing traversal sequences pointing to a target file outside the intended directory. The server returns the contents of the requested file in the HTTP response. No authentication, cookies, or session state are required to trigger the flaw. Refer to the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-10804

Indicators of Compromise

HTTP requests to wp-content/plugins/*/content/downloader.php containing ../ sequences or URL-encoded variants such as %2e%2e%2f
Requests targeting sensitive file paths including wp-config.php, /etc/passwd, or .env via the downloader endpoint
Anomalous outbound responses from the plugin endpoint containing PHP configuration content or system file headers
Repeated 200 OK responses from downloader.php to unauthenticated clients

Detection Strategies

Inspect web server access logs for requests to downloader.php containing traversal patterns or encoded path separators
Deploy WAF rules that block path traversal payloads against WordPress plugin endpoints
Monitor file integrity and audit access events on wp-config.php and other sensitive configuration files

Monitoring Recommendations

Alert on high-volume requests to plugin PHP files from single source IPs
Track unauthenticated GET or POST requests to plugin directories that return large response bodies
Correlate WAF blocks with subsequent authentication or database access anomalies

How to Mitigate CVE-2024-10804

Immediate Actions Required

Deactivate and remove the Ultimate Video Player WordPress & WooCommerce Plugin until a patched version is available
Rotate all secrets stored in wp-config.php, including database credentials and authentication keys, if exploitation is suspected
Apply WAF signatures blocking directory traversal patterns against /wp-content/plugins/ paths
Audit web server logs for prior exploitation attempts referencing downloader.php

Patch Information

No vendor patch is referenced in the available advisories at the time of publication. Site operators should monitor the CodeCanyon plugin listing and the Wordfence Vulnerability Report for fixed release announcements. Until a fix is released, remove the plugin from production environments.

Workarounds

Restrict access to content/downloader.php at the web server layer using deny from all or equivalent location rules
Run the web server process under a least-privileged account that cannot read sensitive system files
Place the WordPress site behind a WAF configured to block path traversal payloads on plugin endpoints

bash

# Apache - block access to the vulnerable endpoint
<Files "downloader.php">
    Require all denied
</Files>

# Nginx - deny requests to the vulnerable plugin file
location ~* /wp-content/plugins/.*/content/downloader\.php$ {
    deny all;
    return 403;
}