CVE-2024-12040: WooCommerce Product Carousel RCE Vulnerability

CVE-2024-12040 Overview

The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 1.9.10. The flaw exists in the theme attribute of the wcpcsu shortcode, which fails to properly validate user-supplied input before including files. Authenticated attackers with Contributor-level access or higher can include and execute arbitrary files on the server. This enables execution of PHP code, bypass of access controls, and disclosure of sensitive data. Where images or other permitted file types can be uploaded, the vulnerability escalates to remote code execution. The issue is tracked under [CWE-98] and was patched in version 1.10.0.

Critical Impact
Contributor-level users can execute arbitrary PHP code on the underlying server, leading to full site compromise.

Affected Products

Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress
All versions up to and including 1.9.10
Fixed in version 1.10.0

Discovery Timeline

2024-12-12 - CVE-2024-12040 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12040

Vulnerability Analysis

The vulnerability resides in the plugin's shortcode handler class-shortcode.php. The wcpcsu shortcode accepts a theme attribute that is passed to a PHP file inclusion routine without sanitization or allowlist validation. Because WordPress evaluates shortcodes within post and page content, any user with edit_posts capability can craft content containing the shortcode. Contributor accounts satisfy this requirement, lowering the exploitation bar significantly.

When the shortcode renders, the plugin resolves the theme value against a file system path and includes it via a PHP include or require statement. Directory traversal sequences within the attribute allow the attacker to break out of the intended templates directory. Any file the web server user can read is included, and if the file contains valid PHP, it executes in the server context.

Root Cause

The root cause is improper control of a filename used in a PHP include statement, classified as [CWE-98]. The plugin trusts the shortcode attribute as a safe theme name and concatenates it into a file path without validating the value against a fixed list of legitimate templates or stripping traversal characters.

Attack Vector

An authenticated Contributor creates a draft post containing the wcpcsu shortcode with a theme attribute pointing to a traversal path or an uploaded file. When the post is previewed or rendered, the plugin includes the target file. Attackers commonly combine this with the WordPress media library, uploading a polyglot image containing PHP code, then referencing that file through the shortcode to achieve code execution.

No verified public exploit code is available. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for technical details of the fix.

Detection Methods for CVE-2024-12040

Indicators of Compromise

Post or page revisions authored by Contributor accounts containing the wcpcsu shortcode with unusual theme attribute values
Web server access log entries showing ?p= or preview URLs referencing posts that trigger the shortcode with traversal patterns such as ../ or absolute paths
Unexpected PHP files or polyglot images in wp-content/uploads/ uploaded shortly before shortcode invocation
Outbound network connections initiated by the PHP-FPM or Apache worker process following shortcode rendering

Detection Strategies

Inspect plugin shortcode attributes in the wp_posts table for wcpcsu entries containing path separators or file extensions in the theme argument
Monitor file access by the web server user for reads of files outside the plugin's templates/ directory during page rendering
Correlate Contributor account activity with subsequent PHP file writes or execution in the uploads directory

Monitoring Recommendations

Enable WordPress audit logging to record post creation and shortcode usage by non-Administrator roles
Forward web server and PHP error logs to a centralized platform to identify inclusion failures and traversal patterns
Alert on new PHP files created in the uploads directory or any writable path outside wp-content/plugins

How to Mitigate CVE-2024-12040

Immediate Actions Required

Update the Product Carousel Slider & Grid Ultimate for WooCommerce plugin to version 1.10.0 or later on all WordPress installations
Audit existing Contributor and Author accounts for unauthorized additions or privilege changes
Review recent post and page content for the wcpcsu shortcode with suspicious theme values and remove affected drafts
Scan wp-content/uploads/ for PHP files or files with double extensions that indicate polyglot uploads

Patch Information

The vendor released version 1.10.0 containing a fix that constrains the theme shortcode attribute. Review the corrected inclusion logic in the WordPress Plugin Changeset. All sites running 1.9.10 or earlier must upgrade.

Workarounds

Deactivate and remove the plugin until patching is possible if the plugin is not in active use
Restrict Contributor role assignments and require Editor or Administrator approval for content containing shortcodes
Configure the web server to deny PHP execution within wp-content/uploads/ to blunt the RCE escalation path
Apply a Web Application Firewall rule that blocks shortcode attributes containing ../, absolute paths, or .php extensions

bash

# Configuration example: block PHP execution in WordPress uploads (Nginx)
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}