CVE-2024-33557: 8theme XStore Core Path Traversal Flaw

CVE-2024-33557 Overview

CVE-2024-33557 is a path traversal vulnerability in the 8theme XStore Core WordPress plugin. The flaw allows authenticated attackers to perform PHP Local File Inclusion (LFI) attacks against affected sites. The issue affects all XStore Core versions up to and including 5.3.8. XStore Core is a companion plugin bundled with the XStore WooCommerce theme, which is widely deployed on e-commerce sites. Successful exploitation lets attackers include arbitrary local PHP files, potentially leading to remote code execution, credential theft, or full site compromise.

Critical Impact
An authenticated attacker with low privileges can traverse the filesystem and include arbitrary PHP files, enabling code execution in the WordPress process context.

Affected Products

8theme XStore Core plugin for WordPress
All versions from initial release through 5.3.8
WordPress sites using the XStore WooCommerce theme with the bundled XStore Core plugin

Discovery Timeline

2024-06-04 - CVE-2024-33557 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33557

Vulnerability Analysis

The vulnerability is classified as Improper Limitation of a Pathname to a Restricted Directory [CWE-22]. XStore Core accepts user-controlled input that is passed to a PHP file inclusion function without adequate sanitization or allow-list validation. Attackers can supply traversal sequences such as ../ to escape the intended template or asset directory. Because PHP inclusion functions execute the contents of the included file as PHP, any accessible file with attacker-controlled content becomes an execution primitive.

Exploitation requires low privileges on the target WordPress instance but does not require user interaction. The scope remains unchanged, and confidentiality, integrity, and availability impacts are all rated high.

Root Cause

The root cause is missing normalization and validation of a filename or template parameter consumed by a PHP include, include_once, require, or require_once call within the XStore Core plugin. Without canonicalization, path traversal payloads reach the inclusion sink and resolve outside the plugin's expected directory scope.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An authenticated user submits a crafted request to a vulnerable XStore Core endpoint containing a manipulated file path parameter. The request coerces the plugin into including a file such as wp-config.php, a log file poisoned with PHP code, or an uploaded media file with a PHP payload. Because inclusion sinks execute PHP, attackers can pivot from file disclosure to code execution when a writable or attacker-controlled file is reachable.

No public proof-of-concept exploit code has been published in the referenced advisory. Refer to the Patchstack Vulnerability Database Entry for vendor and coordinated disclosure details.

Detection Methods for CVE-2024-33557

Indicators of Compromise

HTTP requests to XStore Core endpoints containing traversal sequences such as ../, ..%2f, or URL-encoded null bytes in file or template parameters
Web server access logs showing references to wp-config.php, /etc/passwd, or /proc/self/environ originating from plugin request handlers
Unexpected PHP execution originating from files inside wp-content/uploads/ or other writable directories
New or modified PHP files in the WordPress installation not associated with legitimate updates

Detection Strategies

Inspect WordPress access logs for query strings targeting XStore Core AJAX or REST endpoints combined with path traversal patterns
Deploy Web Application Firewall (WAF) rules that block LFI payloads such as ../, ..\, and encoded variants against plugin request paths
Enable PHP open_basedir restrictions and audit logs for file inclusion attempts outside the plugin directory
Baseline the WordPress filesystem and alert on unexpected PHP files or modifications in wp-content/plugins/ and wp-content/uploads/

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a centralized SIEM for correlation of traversal patterns with authentication events
Monitor authenticated low-privilege accounts (subscriber, customer) for anomalous request volume to plugin endpoints
Track outbound network connections from the PHP worker process to identify post-exploitation command-and-control activity

How to Mitigate CVE-2024-33557

Immediate Actions Required

Update 8theme XStore Core to a version later than 5.3.8 as published by the vendor via the Patchstack advisory
Audit WordPress user accounts and remove or reset credentials for accounts that are no longer needed
Review web server and application logs for prior exploitation attempts targeting XStore Core endpoints
Rotate wp-config.php secrets, database credentials, and API keys if evidence of file disclosure is found

Patch Information

Refer to the Patchstack Vulnerability Database Entry for the fixed version and vendor patch details. Apply the update through the WordPress plugin manager or by replacing the plugin files with the patched release from 8theme.

Workarounds

Restrict access to the WordPress admin interface and plugin endpoints using IP allow-listing at the web server or WAF layer
Configure PHP open_basedir to constrain file inclusion to the WordPress document root
Deploy virtual patching rules in a WAF to block path traversal sequences against XStore Core request handlers until the update is applied
Disable the XStore Core plugin if patching cannot be performed immediately and the plugin is not required for site operation

bash

# Example PHP configuration to constrain file inclusion scope
# /etc/php/8.x/fpm/conf.d/99-wordpress-hardening.ini
open_basedir = "/var/www/wordpress:/tmp"
allow_url_include = Off
allow_url_fopen = Off