CVE-2024-34552: Stockholm Theme Path Traversal Flaw

CVE-2024-34552 Overview

CVE-2024-34552 is a path traversal vulnerability in the Select-Themes Stockholm WordPress theme. The flaw allows authenticated attackers to perform PHP Local File Inclusion (LFI) attacks against affected installations. The vulnerability affects all Stockholm theme versions from an unspecified initial release through version 9.6.

The vulnerability is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). Successful exploitation can lead to inclusion of arbitrary local PHP files, sensitive information disclosure, and potential remote code execution when combined with file upload primitives.

Critical Impact
Authenticated attackers can traverse the file system to include arbitrary PHP files, compromising confidentiality, integrity, and availability of the underlying WordPress installation.

Affected Products

Select-Themes Stockholm WordPress theme (all versions up to and including 9.6)
WordPress sites running vulnerable Stockholm theme installations
Any hosting environment executing PHP with the vulnerable theme active

Discovery Timeline

2024-06-04 - CVE-2024-34552 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34552

Vulnerability Analysis

The Stockholm theme fails to properly sanitize user-supplied input used in file path operations. An attacker with low-privilege authenticated access can supply crafted path sequences containing directory traversal characters such as ../ to escape the intended directory context. The PHP include or require functions then load files outside the expected theme directory.

Because PHP evaluates included files as code, any .php file reachable on the file system executes in the WordPress process context. Attackers with the ability to write files elsewhere on the server, such as uploading images through media libraries, can chain this LFI into remote code execution. The vulnerability requires only low privileges and no user interaction over the network.

Root Cause

The root cause is missing validation of file path parameters passed to PHP file inclusion functions. Stockholm accepts a filename or path parameter, likely through an AJAX endpoint or shortcode handler, and concatenates it into an include, require, or equivalent call without normalizing the path or restricting it to a whitelist of permitted files.

Attack Vector

An authenticated attacker sends an HTTP request to a vulnerable endpoint in the Stockholm theme with a path parameter containing traversal sequences. The theme resolves the path relative to a theme directory and includes the target file. Attackers commonly target wp-config.php for database credentials or PHP session files, log files, and uploaded media to achieve code execution.

Refer to the Patchstack Vulnerability Advisory for additional technical context on the affected endpoints and exploitation preconditions.

Detection Methods for CVE-2024-34552

Indicators of Compromise

HTTP requests containing traversal sequences such as ../, ..%2f, or encoded variants in parameters targeting the Stockholm theme directory under /wp-content/themes/stockholm/
Unexpected access patterns to sensitive files including wp-config.php, /etc/passwd, or PHP session files originating from authenticated WordPress sessions
PHP error log entries showing failed include() or require() calls with unusual paths referencing directories outside the theme root
New or modified PHP files in wp-content/uploads/ created shortly before suspicious inclusion requests

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings and POST bodies for path traversal patterns targeting Stockholm theme paths
Enable PHP open_basedir restrictions and monitor for violations in error_log
Correlate authenticated WordPress user activity with requests to theme endpoints accepting file path parameters
Baseline expected file access patterns for the theme and alert on deviations

Monitoring Recommendations

Forward WordPress access logs, PHP error logs, and WAF telemetry to a centralized log platform for correlation and long-term retention
Monitor file integrity on wp-content/themes/stockholm/ and wp-content/uploads/ for unexpected changes
Alert on outbound connections from the web server process to non-standard destinations, indicating post-exploitation activity

How to Mitigate CVE-2024-34552

Immediate Actions Required

Update the Stockholm theme to a version newer than 9.6 as soon as the vendor releases a patched release
Audit WordPress user accounts and revoke unnecessary Contributor, Author, or Editor privileges to reduce the pool of authenticated attackers
Review web server access logs for prior exploitation attempts using traversal sequences against theme endpoints
Rotate WordPress secrets in wp-config.php and database credentials if compromise is suspected

Patch Information

Refer to the Patchstack Vulnerability Advisory for the latest fixed version information from Select-Themes. Apply the vendor patch through the WordPress admin theme updater or by replacing the theme files directly on the server.

Workarounds

Disable the Stockholm theme and switch to an unaffected theme until a patched version is installed
Configure PHP open_basedir to restrict file inclusion to the WordPress installation directory
Deploy WAF rules blocking requests containing ../, ..%2f, ..%5c, and null byte sequences to theme endpoints
Restrict authenticated user roles capable of invoking the vulnerable endpoints through WordPress role management plugins

bash

# Example PHP open_basedir restriction in php.ini or virtual host config
php_admin_value open_basedir "/var/www/html:/tmp"

# Example ModSecurity rule to block traversal against Stockholm theme
SecRule REQUEST_URI "@contains /wp-content/themes/stockholm/" \
    "chain,deny,status:403,id:1003452,msg:'Stockholm LFI attempt'"
SecRule ARGS "@rx (\.\./|\.\.%2f|\.\.%5c)" "t:lowercase,t:urlDecodeUni"