CVE-2024-31240: WP Poll Maker Path Traversal Vulnerability

CVE-2024-31240 Overview

CVE-2024-31240 is a path traversal vulnerability in the InfoTheme WP Poll Maker plugin for WordPress. The flaw affects all versions up to and including 3.1. Authenticated users with subscriber-level privileges can exploit the vulnerability to delete arbitrary files on the WordPress server. Successful exploitation compromises site integrity and availability, and can lead to site takeover when critical configuration files such as wp-config.php are removed. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated subscribers can delete arbitrary files on the host, enabling site takeover through removal of wp-config.php and other critical WordPress files.

Affected Products

InfoTheme WP Poll Maker plugin for WordPress
All versions from n/a through 3.1
WordPress sites using the epoll-wp-voting plugin package

Discovery Timeline

2024-04-10 - CVE-2024-31240 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31240

Vulnerability Analysis

The WP Poll Maker plugin fails to properly validate user-supplied file path input before performing file deletion operations. An attacker authenticated as a low-privileged subscriber can submit a crafted request containing directory traversal sequences such as ../ in a filename parameter. The plugin resolves the manipulated path outside the intended plugin directory and deletes the target file.

The vulnerability requires only subscriber-level authentication, a role available on any WordPress site that permits user registration. No user interaction beyond the attacker's own session is needed. Impact on integrity and availability is high because arbitrary file deletion can remove core WordPress files, plugin files, or theme assets.

Deleting wp-config.php places the WordPress installation back into its setup state on the next request. An attacker can then re-run the installer, connect the site to an attacker-controlled database, and gain administrative access. This escalation path converts arbitrary file deletion into full site compromise.

Root Cause

The root cause is missing sanitization of file path parameters before passing them to file system deletion functions such as PHP's unlink(). The plugin trusts client-supplied filenames without normalizing the path or confirming the resolved location remains within an allowed directory. Absent an allowlist or realpath() boundary check, traversal sequences bypass the intended file scope.

Attack Vector

The attack is network-based and requires an authenticated subscriber account. The attacker sends an HTTP request to the vulnerable plugin AJAX endpoint with a manipulated file parameter. The parameter contains relative path traversal characters that resolve to a sensitive file outside the plugin's working directory. The server processes the request and deletes the referenced file without further authorization checks.

For technical exploitation details, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-31240

Indicators of Compromise

HTTP POST requests to WP Poll Maker AJAX handlers containing ../ or URL-encoded traversal sequences such as %2e%2e%2f in filename parameters
Unexpected deletion of WordPress core files, including wp-config.php, or plugin and theme files
WordPress installation reverting to the setup wizard state after previously being configured
Requests to plugin endpoints originating from newly created subscriber accounts

Detection Strategies

Inspect web server access logs for requests to wp-admin/admin-ajax.php containing WP Poll Maker action names combined with traversal patterns in parameters
Monitor file integrity on the WordPress installation directory to detect unauthorized deletions of PHP files
Alert on authenticated requests from subscriber accounts that trigger file system write or delete operations

Monitoring Recommendations

Enable WordPress activity logging to record plugin interactions and user role activity
Deploy file integrity monitoring on wp-config.php, .htaccess, and the wp-content/plugins/ and wp-content/themes/ directories
Review new user registrations and correlate subscriber account creation with subsequent plugin endpoint activity

How to Mitigate CVE-2024-31240

Immediate Actions Required

Deactivate and remove the WP Poll Maker plugin until an updated version addressing this vulnerability is confirmed
Disable open user registration on affected WordPress sites, or restrict the subscriber role from accessing plugin functionality
Audit the site for unauthorized file deletions and verify the integrity of wp-config.php and other core files
Rotate WordPress administrator credentials and database credentials if compromise is suspected

Patch Information

No vendor patch is referenced in the available CVE data. The Patchstack Vulnerability Report is the primary source for update status. Administrators should verify the current plugin version and monitor the WordPress plugin repository for a fixed release.

Workarounds

Remove the WP Poll Maker plugin from the WordPress installation if no updated version is available
Restrict access to wp-admin/admin-ajax.php for low-privileged roles using a web application firewall rule
Block HTTP requests to the site that contain path traversal sequences such as ../ or %2e%2e%2f in query parameters or POST bodies
Enforce least-privilege user roles and disable self-registration where not required

bash

# Example WAF rule to block traversal patterns targeting admin-ajax.php
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1002431240,msg:'Path traversal attempt against WP Poll Maker'"
    SecRule ARGS "@rx (\.\./|%2e%2e%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"