CVE-2024-29135: Themefic Tourfic Path Traversal Flaw

CVE-2024-29135 Overview

CVE-2024-29135 is an unrestricted file upload vulnerability in the Themefic Tourfic WordPress plugin. The flaw affects all versions of Tourfic up to and including 2.11.15. Authenticated attackers can upload files of dangerous types to a vulnerable WordPress site. Successful exploitation can lead to arbitrary code execution on the underlying web server. The vulnerability maps to [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
An authenticated attacker with low privileges can upload a malicious file (such as a PHP webshell) and execute arbitrary code, resulting in full compromise of the WordPress site.

Affected Products

Themefic Tourfic WordPress plugin, versions n/a through 2.11.15
WordPress sites running the Tourfic booking and travel plugin
Any deployment allowing authenticated users to interact with vulnerable Tourfic upload endpoints

Discovery Timeline

2024-03-19 - CVE-2024-29135 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29135

Vulnerability Analysis

The Tourfic plugin exposes file upload functionality that fails to validate the type, extension, or content of user-supplied files. Attackers with a valid low-privileged account can submit executable files, such as PHP scripts, through the plugin's upload handler. The uploaded files are stored in a web-accessible directory and served by the WordPress host.

Once placed on disk, the malicious file can be requested directly, causing the web server to execute attacker-controlled code. This grants the attacker command execution in the context of the WordPress process. From that position, an attacker can pivot to database credentials, harvest session material, or persist a backdoor. The vulnerability's network-reachable attack surface and low privilege requirement significantly widen the risk exposure for WordPress operators.

Root Cause

The root cause is the absence of a server-side allowlist for file extensions and MIME types on the plugin's upload endpoints. The plugin trusts client-supplied metadata and writes files into a directory that is served by the web server without further gating. See the Patchstack Vulnerability Report for advisory details.

Attack Vector

An attacker authenticates to WordPress with a low-privileged account. The attacker then issues an HTTP POST request to the vulnerable Tourfic upload handler with a PHP payload disguised or supplied directly. After the file is written to the uploads path, the attacker requests the file over HTTP to trigger execution. No user interaction is required from an administrator to complete the attack.

Detection Methods for CVE-2024-29135

Indicators of Compromise

Unexpected .php, .phtml, .phar, or double-extension files (e.g., image.jpg.php) inside wp-content/uploads/ directories associated with Tourfic
POST requests to Tourfic upload endpoints followed by direct GET requests to newly created files in wp-content/uploads/
New or modified WordPress admin/subscriber accounts created shortly before an upload event
Outbound connections from the web server to unfamiliar hosts after an upload event

Detection Strategies

Monitor WordPress access logs for POST requests to Tourfic AJAX and REST endpoints originating from non-administrative accounts
Scan the wp-content/uploads/ tree for files whose extensions or MIME magic bytes indicate executable server-side content
Alert on any file written to an uploads directory that is subsequently requested with query parameters, a common webshell pattern

Monitoring Recommendations

Enable file integrity monitoring on WordPress content and uploads directories
Forward web server and WordPress audit logs to a centralized platform for correlation of upload and execution events
Review authentication logs for suspicious low-privilege account creation and immediate activity against plugin endpoints

How to Mitigate CVE-2024-29135

Immediate Actions Required

Upgrade the Tourfic plugin to a version later than 2.11.15 as soon as a fixed release is available from Themefic
Audit wp-content/uploads/ for unauthorized executable files and remove any suspicious artifacts
Rotate WordPress administrator credentials and database secrets on any site where compromise is suspected
Restrict registration and reduce the number of low-privileged accounts that can reach Tourfic upload functionality

Patch Information

Refer to the Patchstack Security Advisory for the fixed version and vendor guidance. Apply the vendor-supplied update through the WordPress plugin manager and verify the installed version is above 2.11.15 after upgrade.

Workarounds

Disable the Tourfic plugin until it can be updated to a patched release
Deploy a Web Application Firewall (WAF) rule to block uploads of PHP and other executable extensions to WordPress endpoints
Configure the web server to deny script execution within wp-content/uploads/ using .htaccess rules or equivalent Nginx directives

bash

# Configuration example: block PHP execution in the WordPress uploads directory (Apache .htaccess)
<FilesMatch "\.(php|phtml|phar|php\d)$">
    Require all denied
</FilesMatch>