CVE-2024-12859: BoomBox Theme Extensions RCE Vulnerability

CVE-2024-12859 Overview

CVE-2024-12859 is a Local File Inclusion (LFI) vulnerability in the BoomBox Theme Extensions plugin for WordPress. The flaw affects all plugin versions up to and including 1.8.0. Authenticated attackers with contributor-level access or higher can exploit the type attribute of the boombox_listing shortcode to include and execute arbitrary files on the server. Successful exploitation enables PHP code execution, access control bypass, and disclosure of sensitive data. The issue is tracked under CWE-98, improper control of filename for include/require statement in PHP.

Critical Impact
Contributor-level attackers can execute arbitrary PHP code on the underlying WordPress host by abusing shortcode input passed to a PHP include statement.

Affected Products

WordPress sites running the BoomBox Theme Extensions plugin
BoomBox Theme Extensions plugin versions <= 1.8.0
PX Lab BoomBox theme deployments bundling the vulnerable extensions plugin

Discovery Timeline

2025-02-03 - CVE-2024-12859 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12859

Vulnerability Analysis

The BoomBox Theme Extensions plugin registers a boombox_listing shortcode that accepts a type attribute. The plugin passes this attribute into a PHP include or require call without adequate sanitization or allow-list validation. Attackers with contributor-level permissions can embed the shortcode inside post content and control the value of type. The include path resolves to arbitrary files on the server, and any PHP file reached through the include executes in the WordPress process context.

The attack chain is straightforward. A contributor drafts or submits a post containing a crafted boombox_listing shortcode. When the post is rendered, the plugin evaluates the shortcode and includes the attacker-controlled path. Because the include is server-side, PHP interprets the file, granting the attacker code execution equivalent to the web server user.

Root Cause

The root cause is improper control of a filename used in a PHP include statement [CWE-98]. Shortcode attribute values flow into a filesystem path without whitelisting the permitted type values against a known-good set of template files.

Attack Vector

Exploitation requires network access to the WordPress site and authenticated contributor-or-higher credentials. No user interaction is required beyond triggering the render of a post containing the malicious shortcode. If an attacker can also upload a file with PHP content, for example through media upload weaknesses or metadata fields, they can chain the LFI into full remote code execution.

For technical detail on the affected shortcode handler, see the Wordfence Vulnerability Report and the PX Lab Changelog.

Detection Methods for CVE-2024-12859

Indicators of Compromise

Post content containing the boombox_listing shortcode with a type attribute referencing traversal sequences such as ../ or absolute filesystem paths.
Requests to WordPress pages that render posts authored by low-privilege contributor accounts followed by unexpected outbound connections or PHP errors.
Newly created or modified PHP files under wp-content/uploads/ timestamped close to contributor post activity.

Detection Strategies

Search the wp_posts table for post content matching the pattern boombox_listing combined with suspicious type values.
Enable WordPress debug logging and review PHP include/require warnings referencing unexpected paths.
Correlate contributor account post-publish events with web server access log entries returning HTTP 500 or long response times.

Monitoring Recommendations

Alert on contributor or author account creation immediately followed by post drafts containing shortcodes.
Monitor for PHP file writes to upload directories and any subsequent HTTP requests to those files.
Track plugin version inventory across WordPress fleets to detect BoomBox Theme Extensions installations at or below 1.8.0.

How to Mitigate CVE-2024-12859

Immediate Actions Required

Update the BoomBox Theme Extensions plugin to a version above 1.8.0 as listed in the PX Lab Changelog.
Audit contributor, author, and editor accounts. Reset credentials for any account with unexplained post activity.
Review recent posts for the boombox_listing shortcode and inspect uploaded files under wp-content/uploads/ for unauthorized PHP content.

Patch Information

Refer to the vendor changelog at PX Lab Changelog for the fixed release. Wordfence tracks the vulnerability record and remediation status at the Wordfence Vulnerability Report.

Workarounds

Restrict contributor role assignments and require editor approval before publishing posts that contain shortcodes.
Deploy a web application firewall rule that blocks requests containing boombox_listing shortcode attributes with path traversal characters.
Disable PHP execution in the wp-content/uploads/ directory using web server configuration to break the LFI-to-RCE chain.

bash

# Apache: block PHP execution inside uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>