CVE-2024-12035: CS Framework Path Traversal Vulnerability

CVE-2024-12035 Overview

CVE-2024-12035 is an arbitrary file deletion vulnerability in the CS Framework plugin for WordPress. The flaw resides in the cs_widget_file_delete() function, which fails to validate user-supplied file paths. All plugin versions up to and including 6.9 are affected.

Authenticated attackers with Subscriber-level access or higher can delete arbitrary files on the underlying server. Deletion of critical files such as wp-config.php can trigger WordPress reinitialization, enabling remote code execution. The weakness is classified under CWE-22 (Path Traversal).

Critical Impact

Low-privileged authenticated users can delete arbitrary server files, leading to remote code execution when sensitive files like wp-config.php are targeted.

Affected Products

• CS Framework plugin for WordPress, all versions through 6.9
• WordPress sites bundling the JobCareer theme that ships CS Framework
• Any deployment where Subscriber or higher registration is enabled

Discovery Timeline

• 2025-03-07 - CVE-2024-12035 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12035

Vulnerability Analysis

The CS Framework plugin exposes an AJAX-reachable handler named cs_widget_file_delete(). This function accepts a file path parameter and invokes a delete operation without normalizing the input or restricting it to an allow-listed directory.

Because the endpoint is available to any authenticated user, an attacker only needs Subscriber-level credentials. On many WordPress deployments, Subscriber accounts can be self-registered, effectively lowering the barrier to exploitation.

Deleting wp-config.php forces WordPress into its setup routine. An attacker who can reach the site during that window can point the installation at an attacker-controlled database and gain full administrative access, which pivots to remote code execution through plugin or theme uploads.

Root Cause

The root cause is insufficient file path validation in cs_widget_file_delete(). The function does not canonicalize the supplied path, reject traversal sequences such as ../, or confine deletions to a designated widget upload directory. It also lacks a capability check that would restrict the action to administrators.

Attack Vector

Exploitation occurs over the network against the WordPress admin-ajax endpoint. An authenticated attacker submits a crafted request containing a relative or absolute path referencing a sensitive file. The vulnerable handler resolves the path and calls the underlying delete primitive, removing the target file from disk.

No synthetic proof-of-concept code is reproduced here. Refer to the Wordfence Vulnerability Report for further technical detail.

Detection Methods for CVE-2024-12035

Indicators of Compromise

• Unexpected deletion of wp-config.php, .htaccess, or plugin bootstrap files followed by a WordPress setup screen appearing on the site.
• Web server access logs showing POST requests to admin-ajax.php with an action referencing cs_widget_file_delete originating from low-privileged accounts.
• New administrator accounts created shortly after a WordPress reinstallation event.

Detection Strategies

• Alert on file deletion events targeting WordPress core configuration files, particularly wp-config.php, from the web server process.
• Correlate authenticated Subscriber sessions with AJAX requests invoking plugin file-management actions.
• Inspect HTTP request bodies for path traversal sequences such as ../ reaching admin-ajax.php.

Monitoring Recommendations

• Enable file integrity monitoring on the WordPress root and wp-content directories.
• Log and review all successful and failed AJAX actions that mutate server-side files.
• Track newly registered Subscriber accounts, especially on sites where open registration is enabled.

How to Mitigate CVE-2024-12035

Immediate Actions Required

• Deactivate the CS Framework plugin on affected WordPress installations until a fixed release is applied.
• Disable open user registration or restrict the default new-user role to a non-privileged custom role where possible.
• Audit existing Subscriber-level accounts and remove any that are unrecognized.
• Restore any missing WordPress core files from a known-good backup before returning the site to production.

Patch Information

The vulnerability affects all CS Framework plugin versions up to and including 6.9. Site owners should upgrade to a vendor-supplied release that patches cs_widget_file_delete() once available. Consult the Wordfence Vulnerability Report and the ThemeForest Theme Overview for vendor update status.

Workarounds

• Apply a web application firewall rule that blocks admin-ajax.php requests containing traversal sequences or references to cs_widget_file_delete.
• Set restrictive filesystem permissions so the PHP process cannot delete wp-config.php or files outside wp-content/uploads.
• Move wp-config.php one directory above the WordPress webroot, which WordPress supports natively, to limit exposure.

# Restrict write and delete permissions on wp-config.php
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php

# Optional: block the vulnerable AJAX action at the web server
# Example nginx snippet
if ($arg_action = "cs_widget_file_delete") {
    return 403;
}