CVE-2024-13538: BigBuy Dropshipping Full Path Disclosure

CVE-2024-13538 Overview

CVE-2024-13538 is a Full Path Disclosure vulnerability in the BigBuy Dropshipping Connector for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 2.0.0. The issue stems from the /vendor/cocur/slugify/bin/generate-default.php file being directly accessible over the web. When accessed, the script triggers a PHP error that reveals the absolute filesystem path of the web application. Unauthenticated attackers can query this file remotely to harvest server path information used to enable further attacks.

Critical Impact
Unauthenticated remote attackers can retrieve the full server path of the WordPress installation, providing reconnaissance data that assists in chaining subsequent exploits against the target.

Affected Products

BigBuy Dropshipping Connector for WooCommerce plugin for WordPress
All plugin versions up to and including 2.0.0
Deployments bundling the vulnerable cocur/slugify vendor script at /vendor/cocur/slugify/bin/generate-default.php

Discovery Timeline

2025-02-18 - CVE-2024-13538 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13538

Vulnerability Analysis

The vulnerability is classified under [CWE-209] Generation of Error Message Containing Sensitive Information and [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The plugin ships a third-party helper script from the cocur/slugify library inside its vendor directory. That script is a command-line utility never intended for direct HTTP invocation. Because the plugin does not block web access to the vendor path, the file can be requested directly through the browser. When PHP executes the script outside its expected CLI context, it fails and emits an unhandled error that includes the absolute server path. The disclosed path is not damaging on its own but provides reconnaissance that supports Local File Inclusion, log poisoning, or targeted deserialization attempts.

Root Cause

The root cause is twofold. First, a vendor CLI script is web-reachable due to missing directory hardening. Second, the plugin does not suppress verbose PHP error output for third-party components. Together these gaps expose internal filesystem structure to unauthenticated visitors.

Attack Vector

Exploitation requires only an HTTP GET request to the vulnerable path on the target site. No authentication, user interaction, or elevated privileges are needed. An attacker requests /wp-content/plugins/bigbuy-wc-dropshipping-connector/vendor/cocur/slugify/bin/generate-default.php and reads the resulting PHP error, which contains the absolute installation path.

// No verified proof-of-concept code is published. See the
// [Wordfence Vulnerability Report](https://www.wordfence.com/threat-intel/vulnerabilities/id/15f38b3e-69fe-436f-ba4b-7985ec9dac00?source=cve)
// and the [WordPress Plugin File](https://plugins.trac.wordpress.org/browser/bigbuy-wc-dropshipping-connector/tags/2.0.0/vendor/cocur/slugify/bin/generate-default.php)
// for technical references.

Detection Methods for CVE-2024-13538

Indicators of Compromise

HTTP GET requests targeting /wp-content/plugins/bigbuy-wc-dropshipping-connector/vendor/cocur/slugify/bin/generate-default.php
Web server responses containing PHP error strings such as Fatal error or Uncaught Error combined with absolute filesystem paths
Repeated 500-series responses tied to the plugin's vendor directory from a single external IP

Detection Strategies

Inspect web access logs for direct requests to any .php file under the plugin's vendor/ directory, which is never a legitimate application entry point
Correlate 500 response codes with source IPs that also scan other plugin paths, indicating reconnaissance behavior
Deploy web application firewall rules that flag or block direct access to wp-content/plugins/*/vendor/**/*.php

Monitoring Recommendations

Enable PHP error logging to a private log file rather than the HTTP response body so disclosed paths never reach clients
Alert on outbound HTTP responses that contain filesystem strings like /var/www/, /home/, or C:\\inetpub\\ inside error output
Track installed plugin inventory to identify sites still running BigBuy Dropshipping Connector version 2.0.0 or earlier

How to Mitigate CVE-2024-13538

Immediate Actions Required

Update the BigBuy Dropshipping Connector for WooCommerce plugin to a version later than 2.0.0 once the vendor publishes a fix
Block direct web access to the plugin's vendor/ directory using web server or WAF rules
Disable PHP display_errors in production php.ini so error output never appears in HTTP responses

Patch Information

Refer to the WordPress Changeset and the Wordfence Vulnerability Report for remediation status and current fixed version guidance.

Workarounds

Remove or restrict execute permissions on /vendor/cocur/slugify/bin/generate-default.php if the plugin cannot be updated immediately
Add an Apache or Nginx rule denying HTTP requests to any file inside wp-content/plugins/bigbuy-wc-dropshipping-connector/vendor/
Set PHP display_errors = Off and log_errors = On to prevent path leakage through error output

bash

# Nginx: block direct access to plugin vendor directories
location ~* /wp-content/plugins/[^/]+/vendor/.*\.php$ {
    deny all;
    return 403;
}

# php.ini: suppress error output to browsers
display_errors = Off
log_errors = On
error_log = /var/log/php/error.log