CVE-2024-1382: Restaurant Reservations Plugin RCE Vulnerability

CVE-2024-1382 Overview

CVE-2024-1382 is a Local File Inclusion (LFI) vulnerability in the Restaurant Reservations plugin for WordPress developed by nicdarkthemes. The flaw affects all versions up to and including 1.9. Attackers exploit the nd_rst_layout attribute of the nd_rst_search shortcode to include and execute arbitrary PHP files on the server. Authenticated users with contributor-level access or higher can leverage this weakness to bypass access controls, read sensitive data, or achieve remote code execution when combined with a file upload primitive. The vulnerability is categorized under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Authenticated contributors can execute arbitrary PHP code on the underlying WordPress server, leading to full site compromise.

Affected Products

Nicdarkthemes Restaurant Reservations plugin for WordPress
All versions up to and including 1.9
WordPress installations using the nd_rst_search shortcode

Discovery Timeline

2024-03-07 - CVE-2024-1382 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1382

Vulnerability Analysis

The vulnerability resides in the plugin's search rendering logic at addons/visual/search/index.php. The nd_rst_search shortcode accepts a user-controllable nd_rst_layout attribute. The plugin passes this attribute into a PHP include or require call without validating or sanitizing the path. As a result, attackers can supply relative path traversal sequences to reference arbitrary PHP files present on the server filesystem.

Because the shortcode runs in the context of a WordPress post or page, any user permitted to author content — contributor role and above — can embed the shortcode with a malicious nd_rst_layout value. WordPress renders the post, the plugin evaluates the shortcode, and the referenced PHP file is executed with the privileges of the web server process.

Root Cause

The root cause is unvalidated input reaching a dynamic file inclusion sink. The plugin trusts the nd_rst_layout shortcode attribute and uses it to construct a filesystem path passed to a PHP include statement. There is no allowlist of permitted layout names, no basename normalization, and no restriction on directory traversal characters, matching the pattern described in [CWE-98].

Attack Vector

An authenticated attacker with contributor privileges creates a post or page containing the nd_rst_search shortcode with a crafted nd_rst_layout attribute pointing to a file on the server. When the post is previewed or published and viewed, the plugin includes and executes the referenced PHP file. Attackers commonly chain LFI with log poisoning, session file writes, or an available media upload primitive to achieve arbitrary code execution. Refer to the WordPress Plugin Search Index and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2024-1382

Indicators of Compromise

Post or page content containing the nd_rst_search shortcode with unusual nd_rst_layout values, especially those including ../, absolute paths, or non-standard filenames.
Web server access log entries showing PHP execution originating from unexpected paths under the WordPress uploads or plugin directories.
New or modified PHP files in wp-content/uploads/ following contributor activity.
Outbound connections from the web server process to attacker-controlled infrastructure shortly after post preview or publish events.

Detection Strategies

Scan post and postmeta tables for shortcode invocations matching the pattern nd_rst_search with a nd_rst_layout attribute referencing directory traversal or absolute paths.
Monitor PHP include and require operations against the Restaurant Reservations plugin directory for path arguments that resolve outside the expected layout folder.
Correlate contributor-level content creation events with subsequent anomalous PHP file executions on the host.

Monitoring Recommendations

Enable WordPress audit logging for post creation, revision, and preview actions performed by contributor and author roles.
Forward web server and PHP error logs to a centralized platform to detect inclusion errors referencing unexpected paths.
Alert on new PHP files written to writable WordPress directories, particularly wp-content/uploads/.

How to Mitigate CVE-2024-1382

Immediate Actions Required

Update the Restaurant Reservations plugin to a version later than 1.9 that includes the fix committed in the WordPress Changeset History.
Audit contributor, author, editor, and administrator accounts and remove any that are unused or unrecognized.
Review recent posts and revisions for use of the nd_rst_search shortcode with suspicious nd_rst_layout values.
Inspect the WordPress uploads directory for unauthorized PHP files and remove them.

Patch Information

The vendor addressed the vulnerability in a subsequent release. The remediation is documented in the plugin's trunk changeset referenced in the WordPress Changeset History. Site operators should apply the update through the WordPress plugin manager and verify the installed version is greater than 1.9.

Workarounds

Deactivate and remove the Restaurant Reservations plugin until the patched version is installed.
Restrict contributor and author accounts to trusted users, and require multi-factor authentication for all content-authoring roles.
Configure a web application firewall rule to block requests containing the nd_rst_search shortcode with path traversal sequences in the nd_rst_layout parameter.
Set PHP open_basedir to constrain include paths to the WordPress installation directory, limiting the reach of LFI attempts.

bash

# Configuration example: constrain PHP include paths via open_basedir
# Add to php.ini or the site's PHP-FPM pool configuration
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
allow_url_include = Off