CVE-2024-12849 Overview
CVE-2024-12849 is an arbitrary file read vulnerability in the Error Log Viewer By WP Guru plugin for WordPress. The flaw affects all versions up to and including 1.0.1.3 and is reachable through the wp_ajax_nopriv_elvwp_log_download AJAX action. Because the action is registered with the nopriv hook, unauthenticated attackers can invoke it remotely to read the contents of arbitrary files on the server. Sensitive material such as wp-config.php, private keys, environment files, and system credentials becomes exposed. The issue is classified as a Path Traversal weakness under [CWE-22].
Critical Impact
Unauthenticated remote attackers can read arbitrary files on the WordPress server, including wp-config.php containing database credentials and authentication secrets.
Affected Products
- Error Log Viewer By WP Guru plugin for WordPress
- All versions up to and including 1.0.1.3
- WordPress sites with the plugin installed and activated
Discovery Timeline
- 2025-01-07 - CVE-2024-12849 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12849
Vulnerability Analysis
The vulnerability resides in the plugin's log download handler, registered through the wp_ajax_nopriv_elvwp_log_download AJAX hook. WordPress exposes this hook to unauthenticated visitors by design. The handler accepts a file path parameter and returns the file contents without verifying that the requested path is constrained to the intended log directory.
Because no capability check, nonce validation, or path canonicalization is enforced, an attacker can supply path traversal sequences or absolute paths. The plugin then reads and returns the contents of any file readable by the web server user. This places the [CWE-22] Path Traversal weakness directly on a network-reachable, pre-authentication endpoint.
The EPSS probability of 47.137% (98.682 percentile) indicates active interest from opportunistic scanners targeting vulnerable WordPress installations.
Root Cause
The handler at the locations referenced in the plugin source (error-log-viewer-wp.php lines 295 and 479) takes attacker-controlled input and passes it to a file read operation. The code path lacks three controls: authentication enforcement, allow-list validation of the target path, and resolution of .. traversal sequences against a fixed base directory.
Attack Vector
An attacker sends a crafted HTTP POST request to /wp-admin/admin-ajax.php with action=elvwp_log_download and a file parameter containing the target path. No authentication, cookie, or nonce is required. The server responds with the raw file contents. Attackers commonly chain this primitive by reading wp-config.php to extract database credentials, secret keys, and authentication salts for follow-on compromise.
No verified public exploit code is referenced in the advisory. See the Wordfence Vulnerability Report and the vulnerable plugin source for technical details.
Detection Methods for CVE-2024-12849
Indicators of Compromise
- HTTP requests to /wp-admin/admin-ajax.php containing action=elvwp_log_download from unauthenticated sources
- Request parameters containing path traversal sequences such as ../, ..%2f, or absolute paths like /etc/passwd or wp-config.php
- Anomalous outbound responses from admin-ajax.php returning content sizes inconsistent with log file responses
- Web server access logs showing repeated elvwp_log_download requests from a single IP
Detection Strategies
- Inspect access logs for the string elvwp_log_download and review the associated file parameters
- Deploy WAF rules that block path traversal patterns on requests targeting the elvwp_log_download action
- Correlate requests to admin-ajax.php with subsequent authentication failures or administrative logins that may indicate credential reuse from leaked wp-config.php
Monitoring Recommendations
- Alert on any access to wp-config.php, .env, or /etc/passwd strings appearing in HTTP query or body parameters
- Track unauthenticated POST volume to admin-ajax.php and flag spikes
- Monitor file integrity on plugin directories to confirm patched versions remain installed
How to Mitigate CVE-2024-12849
Immediate Actions Required
- Update the Error Log Viewer By WP Guru plugin to a version newer than 1.0.1.3 immediately
- If a patched version is unavailable, deactivate and remove the plugin from all WordPress installations
- Rotate any secrets that may have been exposed, including database passwords, WordPress authentication keys, and salts in wp-config.php
- Audit access logs for prior exploitation attempts targeting the elvwp_log_download action
Patch Information
The vendor addressed the issue in a subsequent release following version 1.0.1.3. Review the WordPress Changeset Details for the specific code changes that introduce authentication checks and path validation on the affected handler.
Workarounds
- Block requests to admin-ajax.php containing action=elvwp_log_download at the WAF or reverse proxy layer
- Restrict access to /wp-admin/ from trusted IP ranges where operationally feasible
- Apply filesystem permissions that prevent the web server user from reading sensitive files outside the WordPress document root
# Example WAF rule (ModSecurity) to block the vulnerable action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
"chain,deny,status:403,id:1024849,msg:'Block CVE-2024-12849 exploitation'"
SecRule ARGS:action "@streq elvwp_log_download" "t:lowercase"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
