CVE-2024-12811: Traveler WordPress Theme RCE Vulnerability

CVE-2024-12811 Overview

The Traveler theme for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 3.1.9. The flaw exists in the theme's shortcode handling, which fails to properly validate file paths passed as parameters. Authenticated attackers with contributor-level access or above can include and execute arbitrary files on the server. Successful exploitation allows execution of PHP code contained within included files, bypass of access controls, and disclosure of sensitive data. Where an attacker can upload files with a .php extension and then include them, the flaw enables full remote code execution. The vulnerability is tracked under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.

Critical Impact
Contributor-level attackers can achieve arbitrary PHP code execution on any WordPress site running the Traveler theme version 3.1.9 or earlier.

Affected Products

Traveler theme for WordPress — all versions ≤ 3.1.9
WordPress installations using the Traveler theme with contributor-level or higher user roles enabled
Sites permitting file uploads with .php extensions in combination with the Traveler theme

Discovery Timeline

2025-02-28 - CVE-2024-12811 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12811

Vulnerability Analysis

The Traveler theme registers WordPress shortcodes that accept file path parameters and pass them to PHP include or require statements. The shortcode handlers do not sanitize the file path input against a whitelist of permitted files or directories. Any authenticated user who can insert shortcodes into posts, which includes the default contributor role, can trigger inclusion of arbitrary server-side files. When an included file contains PHP code, the WordPress process executes that code with the privileges of the web server user.

The attack scope extends beyond simple file disclosure. Attackers can target configuration files such as wp-config.php to extract database credentials, or read log files to harvest session tokens. Where the WordPress site permits uploads of files with a .php extension through media libraries, plugins, or misconfigured directories, an attacker can upload a payload and then include it via the vulnerable shortcode to achieve remote code execution.

Root Cause

The root cause is improper control of a filename passed to a PHP include or require statement, classified as CWE-98. The vulnerable shortcode handlers concatenate user-controlled input into an include path without canonicalization or allow-list validation. Path traversal sequences such as ../ are not filtered, allowing traversal outside the theme directory.

Attack Vector

Exploitation requires an authenticated session with contributor-level privileges or higher. The attacker creates or edits a post containing a malicious shortcode with a crafted file path parameter. When the post is rendered, the theme evaluates the shortcode and includes the attacker-specified file. The attack proceeds entirely over HTTP or HTTPS and does not require user interaction beyond the attacker's authenticated actions.

Detailed technical analysis is published in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-12811

Indicators of Compromise

Post or page content containing Traveler theme shortcodes with file path parameters referencing paths outside the theme directory, such as ../../wp-config.php or absolute paths.
Web server access logs showing authenticated POST requests to wp-admin/post.php or wp-admin/post-new.php from contributor accounts, followed by GET requests rendering the modified post.
Newly created files with .php extensions in upload directories (wp-content/uploads/) that do not correspond to legitimate media assets.
PHP error logs referencing failed includes of unexpected file paths under the WordPress installation.

Detection Strategies

Audit all posts and custom fields for Traveler shortcodes that reference file paths, particularly those containing traversal characters or absolute paths.
Enable WordPress audit logging to record post creation and modification events tied to contributor accounts.
Deploy a web application firewall rule that inspects POST bodies for shortcode patterns containing ../ sequences or paths outside wp-content/themes/traveler/.

Monitoring Recommendations

Monitor for anomalous PHP process behavior originating from the web server user, including outbound network connections and unexpected child processes.
Alert on any file writes to WordPress directories by the web server process outside of normal update windows.
Track contributor and author account activity, especially newly created accounts followed by immediate post creation containing shortcodes.

How to Mitigate CVE-2024-12811

Immediate Actions Required

Update the Traveler theme to a version later than 3.1.9 as published in the Traveler WP Changelog.
Review all contributor, author, editor, and administrator accounts and remove any that are inactive or unrecognized.
Audit existing posts and pages for malicious Traveler shortcodes and remove any suspicious file inclusions.
Scan the wp-content/uploads/ directory and other writable paths for unauthorized .php files and delete them.

Patch Information

The vendor addressed the vulnerability in a release subsequent to version 3.1.9. Administrators should consult the Traveler WP Changelog for the specific fixed version and apply the update through the WordPress theme update interface or by replacing theme files manually. After patching, clear any cached page output to ensure vulnerable shortcode handlers are no longer served.

Workarounds

Restrict the contributor role or higher from being assigned to untrusted users until the theme is patched.
Configure the web server to deny execution of PHP files within the wp-content/uploads/ directory using an .htaccess rule or equivalent server directive.
Deploy a WordPress security plugin or web application firewall with virtual patching rules for CVE-2024-12811.
Disable the Traveler theme temporarily and switch to a default WordPress theme if patching cannot be performed immediately.

bash

# Apache: deny PHP execution in the uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.php$">
    Require all denied
</FilesMatch>

# Nginx: add to the server block
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}