CVE-2024-13537: C9 Blocks Information Disclosure Flaw

CVE-2024-13537 Overview

CVE-2024-13537 is a Full Path Disclosure vulnerability in the Covertnine C9 Blocks plugin for WordPress. The flaw affects all versions up to and including 1.7.7. The plugin ships with a publicly accessible composer-setup.php file that has PHP error display enabled. Unauthenticated attackers can request this file over the network and receive error output that reveals the absolute filesystem path of the WordPress installation. The disclosed path is not directly exploitable on its own, but it provides reconnaissance value that helps attackers chain the information into other vulnerabilities such as Local File Inclusion or arbitrary file operations. The issue is tracked under [CWE-209] (Generation of Error Message Containing Sensitive Information).

Critical Impact
Unauthenticated remote attackers can retrieve the absolute server path of the WordPress installation, aiding follow-on exploitation of other vulnerabilities.

Affected Products

Covertnine C9 Blocks plugin for WordPress, all versions through 1.7.7
WordPress sites with the c9-blocks plugin installed and activated
Installations exposing wp-content/plugins/c9-blocks/composer-setup.php to the internet

Discovery Timeline

2025-02-21 - CVE-2024-13537 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13537

Vulnerability Analysis

The C9 Blocks plugin distributes a composer-setup.php script inside the plugin directory. This file is reachable directly over HTTP without authentication. The script executes with PHP error reporting and display enabled, so when the request triggers warnings or notices, PHP writes the absolute filesystem path of the script into the HTTP response. An attacker retrieves this path with a single GET request and learns the exact document root and plugin location on the underlying server.

Full Path Disclosure by itself does not modify data or grant access. It becomes useful when combined with other bugs. For example, an LFI vulnerability that requires an absolute path, a log poisoning attempt, or an arbitrary file write primitive all benefit from knowing the server's real path layout. The disclosure also confirms the operating system family and hosting pattern, which narrows the attacker's exploitation choices.

Root Cause

Two design decisions combine to produce the vulnerability. First, composer-setup.php is placed in a web-accessible location under the plugin directory instead of being restricted to build tooling. Second, the script enables PHP error display so uncaught warnings are written to the response body. The plugin does not gate access with authentication or a capability check, and no .htaccess or web server rule blocks direct requests to the file.

Attack Vector

Exploitation requires only network access to the target WordPress site. An unauthenticated attacker issues an HTTP GET request to the plugin's composer-setup.php endpoint, for example https://target.example/wp-content/plugins/c9-blocks/composer-setup.php. The server returns PHP error output containing the absolute filesystem path. No user interaction, credentials, or special privileges are required. See the WordPress Plugin Composer Setup source and the Wordfence Vulnerability Report for the technical description.

Detection Methods for CVE-2024-13537

Indicators of Compromise

HTTP GET requests to /wp-content/plugins/c9-blocks/composer-setup.php in web server access logs
HTTP 200 responses to composer-setup.php containing strings such as Warning:, Fatal error:, or absolute filesystem paths like /var/www/ or C:\inetpub\
Repeated reconnaissance scans from a single source IP against multiple composer-setup.php, phpinfo.php, or similar files

Detection Strategies

Query web server and WAF logs for direct requests to any composer-setup.php under wp-content/plugins/
Inspect outbound responses for PHP error signatures leaking absolute paths and flag responses that include them
Run an authenticated vulnerability scan that enumerates the installed WordPress plugin versions and flags c9-blocks at or below 1.7.7

Monitoring Recommendations

Alert on any HTTP request path matching composer-setup.php on production WordPress hosts
Track WordPress plugin inventory and version drift so vulnerable c9-blocks installations are visible to the security team
Correlate Full Path Disclosure hits with follow-on requests from the same source that target file inclusion or upload endpoints

How to Mitigate CVE-2024-13537

Immediate Actions Required

Block public access to wp-content/plugins/c9-blocks/composer-setup.php at the web server or WAF layer
Disable the C9 Blocks plugin on any site where it is not actively required
Confirm that PHP display_errors is set to Off in production php.ini and any per-site overrides

Patch Information

No fixed version is listed in the NVD entry for CVE-2024-13537 at the time of publication. Administrators should monitor the Wordfence Vulnerability Report and the plugin's WordPress.org page for a vendor-supplied update. Until a patched release is available, apply the workarounds below.

Workarounds

Add a web server rule that returns 403 Forbidden for any request matching composer-setup.php under the plugin directory
Set PHP display_errors = Off and log_errors = On so errors go to logs rather than HTTP responses
Remove the composer-setup.php file from the plugin directory if the plugin does not require it at runtime
Restrict access to the /wp-content/plugins/c9-blocks/ path to trusted administrative IP ranges where operationally feasible

bash

# Apache: deny direct access to composer-setup.php inside the c9-blocks plugin
<Files "composer-setup.php">
    Require all denied
</Files>

# Nginx: return 403 for composer-setup.php under the plugin path
location ~* /wp-content/plugins/c9-blocks/composer-setup\.php$ {
    deny all;
    return 403;
}

# php.ini: suppress error output in production
display_errors = Off
log_errors = On