CVE-2024-12272: WP Travel Engine Elementor RCE Vulnerability

CVE-2024-12272 Overview

CVE-2024-12272 is a Local File Inclusion (LFI) vulnerability in the WP Travel Engine – Elementor Widgets plugin for WordPress. The flaw affects all plugin versions up to and including 1.3.7 and stems from unsafe file inclusion within several widgets. Authenticated users with Contributor-level access or higher can include and execute arbitrary files on the server. Successful exploitation allows execution of any PHP code contained in those files, enabling access control bypass, sensitive data disclosure, or full code execution when attackers can upload images or other files considered safe.

Critical Impact
Contributor-level accounts can achieve remote code execution on the WordPress server by including attacker-controlled or uploaded files through vulnerable widget parameters.

Affected Products

WP Travel Engine – Elementor Widgets plugin for WordPress (all versions)
Versions up to and including 1.3.7
WordPress installations exposing Contributor or higher account registration

Discovery Timeline

2024-12-25 - CVE-2024-12272 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-12272

Vulnerability Analysis

The vulnerability is classified as Local File Inclusion under CWE-98, which covers improper control of filename for include or require statements in PHP programs. Several widgets in the WP Travel Engine – Elementor Widgets plugin accept user-controlled input that is passed to PHP file inclusion functions without adequate validation or sanitization.

An authenticated attacker with at least Contributor privileges can supply a path referencing an arbitrary file on the server. When the plugin includes that file, the PHP interpreter executes any code it contains. Because WordPress environments commonly permit uploads of images, PDFs, and other file types, an attacker can plant PHP payloads inside these files and then reach them through the vulnerable widget parameters.

Root Cause

The root cause is unvalidated user input flowing into PHP include, require, or equivalent statements inside multiple plugin widgets. The plugin does not restrict inclusion targets to a whitelist of trusted template paths, nor does it sanitize traversal sequences or enforce a fixed file extension. This weakness aligns directly with CWE-98.

Attack Vector

The attack is remote and requires authentication as a Contributor or higher role. An attacker submits a crafted widget configuration that references a local file path. When the widget renders, the plugin loads and executes the referenced file server-side. Attackers commonly chain this with the media upload capability granted to Contributors, uploading files that contain PHP code disguised as images and then triggering inclusion through the vulnerable widget parameter. See the Wordfence Vulnerability Report and the WordPress Change Log Entry for the corrected code paths.

Detection Methods for CVE-2024-12272

Indicators of Compromise

Web server access logs containing widget requests with parameters carrying path traversal sequences such as ../, absolute filesystem paths, or references to files under wp-content/uploads/.
Recently uploaded media files with double extensions or non-standard content (for example, image files containing <?php byte sequences).
New or modified PHP files inside wp-content/uploads/ or other writable directories.
Unexpected Contributor or Author accounts created shortly before suspicious widget activity.

Detection Strategies

Inspect POST requests to admin-ajax.php and Elementor editor endpoints for parameters that resolve to local filesystem paths.
Deploy WordPress security plugins with rulesets that flag LFI patterns in Elementor widget arguments.
Correlate authentication events for Contributor-level users with immediate widget edits and media uploads.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation, particularly on wp-content/uploads/ and plugin directories.
Forward web server and PHP error logs to a centralized SIEM or data lake for retention and correlation.
Alert on outbound network connections initiated by the PHP worker process, which frequently indicate post-exploitation activity.

How to Mitigate CVE-2024-12272

Immediate Actions Required

Update the WP Travel Engine – Elementor Widgets plugin to a version later than 1.3.7 as soon as the vendor release is available.
Audit all user accounts and remove or downgrade unnecessary Contributor, Author, and Editor accounts.
Review wp-content/uploads/ for unexpected PHP files and remove any that are not part of legitimate plugin or theme functionality.
Rotate WordPress administrator and database credentials if compromise is suspected.

Patch Information

The vendor addressed the issue in the plugin update referenced by the WordPress Change Log Entry. Site administrators should install the fixed release through the WordPress plugin manager or WP-CLI. Additional advisory detail is available in the Wordfence Vulnerability Report.

Workarounds

Disable the WP Travel Engine – Elementor Widgets plugin until the patched version can be applied.
Configure the web server to deny PHP execution inside wp-content/uploads/ and other user-writable directories.
Restrict Contributor-level registrations and enforce manual approval for new author accounts.
Deploy a web application firewall rule that blocks path traversal sequences in Elementor widget parameters.

bash

# Example: block PHP execution within the WordPress uploads directory (Apache)
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>

# Update the vulnerable plugin using WP-CLI
wp plugin update wte-elementor-widgets