CVE-2024-11600 Overview
CVE-2024-11600 is a Remote Code Execution (RCE) vulnerability in the Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress. The flaw affects all versions up to and including 1.6.0. The vulnerability resides in the write_config function, which fails to sanitize data from an imported JSON file. Authenticated attackers with Administrator-level privileges or higher can execute arbitrary code on the underlying server. The issue is categorized under CWE-94 (Improper Control of Generation of Code).
Critical Impact
Successful exploitation allows attackers to execute arbitrary PHP code on the WordPress host, leading to full site compromise and potential lateral movement.
Affected Products
- Visualmodo Borderless plugin for WordPress — all versions up to and including 1.6.0
- WordPress sites using the Borderless toolkit for Elementor
- WordPress sites using the Borderless toolkit for Gutenberg
Discovery Timeline
- 2025-01-30 - CVE-2024-11600 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11600
Vulnerability Analysis
The Borderless plugin exposes an icon-manager component that allows administrators to import icon sets via JSON. The write_config function processes this imported JSON and writes configuration data to disk without sanitizing untrusted content. Because the resulting file is interpreted as PHP, an attacker who controls the imported JSON can inject code that the web server later executes.
The flaw requires Administrator-level access, which raises the exploitation bar but does not eliminate risk. Compromised administrator credentials, malicious insiders, or chained privilege-escalation vulnerabilities in adjacent plugins can all lead to exploitation. Once triggered, the attacker gains code execution in the context of the PHP-FPM or web-server process, exposing site secrets, database credentials, and any files readable by the web user.
Root Cause
The root cause is missing input validation on JSON data consumed by the icon-manager. The write_config function trusts imported values and serializes them into a configuration file without filtering PHP syntax or dangerous characters. The vulnerable logic is visible in the WordPress plugin repository at icon-manager.php lines 249, 333, and 388.
Attack Vector
An authenticated administrator submits a crafted JSON payload to the icon-import functionality. The plugin passes the payload to write_config, which persists attacker-controlled content into a PHP file loaded by the plugin. When the plugin next includes that file, the injected code executes with the privileges of the PHP process. Refer to the Wordfence Vulnerability Report for detailed exploitation notes.
Detection Methods for CVE-2024-11600
Indicators of Compromise
- Unexpected modifications to files under the borderless/includes/icon-manager/ directory or to plugin configuration files written by write_config.
- New or altered PHP files inside the plugin directory with recent timestamps that do not correspond to a plugin update.
- Outbound network connections from the WordPress host to unfamiliar addresses following an icon-set import action.
- Web-server processes (php-fpm, apache2, nginx) spawning shell utilities such as sh, bash, curl, or wget.
Detection Strategies
- Monitor WordPress admin activity logs for icon-manager import events and correlate with subsequent file writes on disk.
- Deploy file-integrity monitoring on the wp-content/plugins/borderless/ tree to alert on unauthorized changes.
- Inspect webserver access logs for POST requests to admin.php or admin-ajax.php referencing icon-manager actions from unexpected administrator accounts.
Monitoring Recommendations
- Alert on child processes of the PHP interpreter that invoke system shells or network utilities.
- Ingest WordPress and webserver logs into a centralized data lake and retain administrator authentication events for correlation.
- Track version inventory of installed WordPress plugins to flag hosts still running Borderless 1.6.0 or earlier.
How to Mitigate CVE-2024-11600
Immediate Actions Required
- Update the Borderless plugin to a version later than 1.6.0 that includes the fix committed in changeset 3231327.
- Audit all WordPress administrator accounts, rotate credentials, and enforce multi-factor authentication.
- Review the borderless/includes/icon-manager/ directory for unexpected PHP files and remove any that were not shipped by the vendor.
Patch Information
Visualmodo addressed the vulnerability in a subsequent release of the Borderless plugin. The corresponding source change is documented in the WordPress plugin repository changeset. Administrators should apply the update through the WordPress plugin manager or by replacing the plugin files manually.
Workarounds
- If patching is not immediately possible, deactivate and remove the Borderless plugin until the update is applied.
- Restrict Administrator role assignments to a minimal set of trusted users and disable direct plugin installation on production sites.
- Deploy a web application firewall (WAF) rule to block requests targeting the icon-manager import endpoint from untrusted networks.
# Verify the installed Borderless plugin version and remove if vulnerable
wp plugin get borderless --field=version
wp plugin deactivate borderless
wp plugin delete borderless
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
