CVE-2024-13471: WordPress Core Features File Read Flaw

CVE-2024-13471 Overview

CVE-2024-13471 affects the DesignThemes Core Features plugin for WordPress through version 4.7. The plugin exposes the dt_process_imported_file function without a capability check, allowing unauthenticated attackers to read arbitrary files on the underlying operating system. The flaw is classified under [CWE-22] Path Traversal and is reachable over the network without authentication or user interaction. Successful exploitation can disclose WordPress configuration files, credentials, and other sensitive host content. The vulnerability impacts confidentiality only, with no direct effect on integrity or availability.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from the WordPress host, including wp-config.php, which often exposes database credentials and authentication secrets.

Affected Products

DesignThemes Core Features plugin for WordPress
All versions up to and including 4.7
WordPress sites bundling the DesignThemes LMS theme and related DesignThemes products

Discovery Timeline

2025-03-05 - CVE-2024-13471 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13471

Vulnerability Analysis

The DesignThemes Core Features plugin registers the dt_process_imported_file function to handle file import operations. The function executes without verifying that the requesting user holds an appropriate WordPress capability such as manage_options or import. Because the handler is exposed to unauthenticated requests, any visitor can invoke it.

The handler accepts a file path parameter and reads its contents during import processing. Without sanitization or restriction to plugin-managed directories, the path parameter can be set to any file readable by the web server process. Attackers can retrieve wp-config.php, system files such as /etc/passwd, log files, and backup archives stored within the filesystem.

The vulnerability falls under arbitrary file read via path traversal. The EPSS probability is 0.498%, placing it in the 38.9 percentile for exploitation likelihood.

Root Cause

The root cause is a missing capability check combined with insufficient input validation on the file path argument. The plugin trusts the caller and the supplied path, violating the principle of least privilege required for any administrative import functionality in WordPress.

Attack Vector

An attacker sends an HTTP request to the vulnerable AJAX or admin-post endpoint that dispatches dt_process_imported_file. The request includes a crafted file path parameter pointing to a target file outside the intended import directory. The server returns or processes the file contents, leaking them to the attacker. No credentials, tokens, or user interaction are required.

The vulnerability is described in prose only; no verified public exploit code is available. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-13471

Indicators of Compromise

Unauthenticated HTTP POST requests to admin-ajax.php with an action value referencing dt_process_imported_file or similar DesignThemes import handlers
Requests containing path traversal sequences such as ../, absolute paths, or references to wp-config.php in parameters
Web server access logs showing repeated import-handler hits from a single IP within a short window
Outbound transfer of sensitive file contents observed in response bodies for unauthenticated sessions

Detection Strategies

Inspect WordPress access logs for admin-ajax.php calls invoking DesignThemes import actions from non-administrator sessions
Deploy web application firewall rules that block path traversal patterns in plugin AJAX parameters
Correlate plugin version inventories against the affected range to identify exposed sites
Alert on responses returning known sensitive strings such as DB_PASSWORD or AUTH_KEY from plugin endpoints

Monitoring Recommendations

Enable verbose logging on the WordPress AJAX layer and forward logs to a centralized SIEM
Monitor file access patterns on wp-config.php and other sensitive files using host-based integrity tools
Track plugin update status across managed WordPress instances and flag versions at or below 4.7
Review outbound bandwidth anomalies from web servers that could indicate bulk file exfiltration

How to Mitigate CVE-2024-13471

Immediate Actions Required

Update the DesignThemes Core Features plugin to a release later than 4.7 as soon as the vendor publishes a fixed version
Rotate any secrets stored in wp-config.php, including database credentials, salts, and API keys, if the site was exposed
Restrict access to the WordPress admin and AJAX endpoints to known IP ranges where feasible
Audit recent web server logs for evidence of exploitation against the dt_process_imported_file handler

Patch Information

Review the Wordfence Vulnerability Report and the ThemeForest LMS Product Page for vendor update notifications. Apply the patched plugin version through the WordPress dashboard or by replacing the plugin directory on disk, then clear any plugin and object caches.

Workarounds

Deactivate the DesignThemes Core Features plugin until a patched version is installed
Add a web application firewall rule that denies unauthenticated requests targeting dt_process_imported_file
Configure the web server to deny direct reads on sensitive files such as wp-config.php and backup archives
Apply filesystem permissions that prevent the web server user from reading files outside the WordPress document root where operationally acceptable

bash

# Example Nginx rule to block unauthenticated calls to the vulnerable action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "dt_process_imported_file") {
        return 403;
    }
}