CVE-2024-13535: Actionwear Products Sync Path Disclosure

CVE-2024-13535 Overview

CVE-2024-13535 is a Full Path Disclosure vulnerability in the Actionwear Products Sync plugin for WordPress. All versions up to and including 2.3.2 are affected. The flaw exists because the composer-setup.php file is publicly accessible with the PHP display_errors directive set to true. Unauthenticated attackers can request this file over the network to reveal the absolute filesystem path of the WordPress installation. The disclosure alone does not compromise the site, but attackers use the path information to strengthen follow-on attacks such as Local File Inclusion or arbitrary file write. The issue maps to [CWE-209] (Generation of Error Message Containing Sensitive Information) and [CWE-22] (Path Traversal).

Critical Impact
Unauthenticated remote attackers can retrieve the absolute installation path of the affected WordPress site, aiding chained exploitation.

Affected Products

Marcoingraiti Actionwear Products Sync plugin for WordPress, all versions through 2.3.2
WordPress sites with the plugin installed and PHP display_errors enabled
CPE: cpe:2.3:a:marcoingraiti:actionwear_products_sync:*:*:*:*:*:wordpress:*:*

Discovery Timeline

2025-02-18 - CVE-2024-13535 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13535

Vulnerability Analysis

The Actionwear Products Sync plugin ships with a composer-setup.php file that remains reachable over HTTP after installation. When PHP display_errors is enabled, executing this file triggers warnings or fatal errors that echo the absolute server path in the response body. Attackers issue a single unauthenticated GET request to the plugin directory to harvest this information. The disclosed path typically follows the format /var/www/html/wp-content/plugins/actionwear-products-sync/ or a hosting-specific equivalent. Information disclosure of this type is a common precursor step for attackers mapping shared hosting environments, evading open_basedir restrictions, or crafting file-inclusion payloads that require the absolute path.

Root Cause

Two issues combine to create the vulnerability. First, the plugin exposes composer-setup.php, a development or installation helper script, in the publicly served plugin directory instead of restricting it to CLI use. Second, the script produces verbose errors under a production PHP configuration where display_errors is set to true. The plugin authors did not include a .htaccess deny rule, an if (!defined('ABSPATH')) exit; guard, or a die() for non-CLI contexts. The upstream fix removes or blocks access to the setup file. See the WordPress Changeset Update for the applied fix.

Attack Vector

Exploitation requires no authentication, no user interaction, and only network access to the target WordPress site. An attacker sends an HTTP request to /wp-content/plugins/actionwear-products-sync/composer-setup.php and parses the returned error output for path strings. The response reveals the web root and plugin directory location. The attacker then combines this data with any secondary vulnerability, such as an LFI, SSRF to file://, or arbitrary file write, to complete a chained compromise. Additional context is documented in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-13535

Indicators of Compromise

HTTP GET requests to /wp-content/plugins/actionwear-products-sync/composer-setup.php from unknown or scanner-associated IP addresses
Web server responses containing absolute filesystem paths, PHP Warning, Notice, or Fatal error strings referencing plugin files
Repeated 200 responses to plugin setup or installer PHP files that should return 403 or 404

Detection Strategies

Review web server access logs for direct requests to plugin .php files outside normal WordPress routing through index.php
Deploy WAF rules that alert on responses containing display_errors output patterns such as /var/www/, /home/, or Stack trace:
Inventory installed WordPress plugins to identify sites running Actionwear Products Sync <= 2.3.2

Monitoring Recommendations

Alert on any HTTP 200 response to requests targeting composer-setup.php, install.php, or similar setup scripts within plugin directories
Monitor for reconnaissance patterns pairing path-disclosure probes with subsequent LFI or file-inclusion attempts from the same source
Track outbound requests originating from the WordPress host that could indicate successful follow-on exploitation

How to Mitigate CVE-2024-13535

Immediate Actions Required

Update the Actionwear Products Sync plugin to a version later than 2.3.2 once available, or remove the plugin if no fixed release is deployed
Set PHP display_errors = Off in php.ini on all production WordPress hosts
Block direct HTTP access to composer-setup.php and other installer scripts within the plugin directory using web server rules

Patch Information

The vendor addressed the issue through the WordPress plugin repository. Review the WordPress Changeset Update for the exact code change and apply the latest plugin version from the WordPress plugin directory. Verify the fix by requesting composer-setup.php after the update and confirming a 403 or 404 response.

Workarounds

Add a web server rule denying access to composer-setup.php within the plugin directory until the patched version is installed
Disable PHP error display in production by setting display_errors = Off and log_errors = On in php.ini
Restrict plugin directory access with an .htaccess rule blocking direct .php execution for non-WordPress-entry files

bash

# Apache .htaccess rule to block direct access to the vulnerable file
<Files "composer-setup.php">
    Require all denied
</Files>

# php.ini hardening to suppress verbose error output
display_errors = Off
log_errors = On
error_log = /var/log/php/error.log