CVE-2024-34554: Stockholm Core Path Traversal Vulnerability

CVE-2024-34554 Overview

CVE-2024-34554 is a path traversal vulnerability in the Select-Themes Stockholm Core plugin for WordPress. The flaw enables PHP Local File Inclusion (LFI) through improper limitation of a pathname to a restricted directory [CWE-22]. All versions of Stockholm Core up to and including 2.4.1 are affected. An authenticated attacker with low privileges can traverse the file system and include arbitrary PHP files on the server. This leads to sensitive information disclosure and potential code execution when combined with file upload primitives or log poisoning. The vulnerability was published to the National Vulnerability Database on June 4, 2024.

Critical Impact
Authenticated attackers can read arbitrary server files and execute included PHP code, compromising confidentiality, integrity, and availability of the WordPress host.

Affected Products

Select-Themes Stockholm Core plugin for WordPress
All versions from n/a through 2.4.1
WordPress sites using the Stockholm theme ecosystem that ship the Stockholm Core plugin

Discovery Timeline

2024-06-04 - CVE-2024-34554 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34554

Vulnerability Analysis

The Stockholm Core plugin accepts user-controlled input that is passed to a PHP file inclusion function without adequate sanitization. Because the input is not validated against an allow-list or normalized to prevent directory traversal sequences, an attacker can supply crafted values containing ../ segments. The server then resolves the path outside the intended template directory and includes the target file through PHP's inclusion machinery.

When the included file contains PHP code, the interpreter executes it in the plugin's context. When the file contains sensitive data such as wp-config.php, database credentials, or system configuration files, the contents are returned in the HTTP response. The Common Weakness Enumeration category assigned is CWE-22: Path Traversal.

Root Cause

The root cause is missing input validation on a request parameter that feeds a PHP include, require, or equivalent statement. The plugin does not normalize the path, restrict the base directory, or enforce a fixed file extension. Any authenticated user with the minimum required role can supply traversal payloads.

Attack Vector

The attack is delivered over the network through standard HTTP or HTTPS requests to the vulnerable WordPress endpoint. Exploitation requires low-privileged authentication but no user interaction. Attackers typically chain LFI with log poisoning, session file abuse, or PHP wrappers such as php://filter to escalate from file read to remote code execution.

See the Patchstack Vulnerability Advisory for advisory-level details.

// No verified public exploit code is available.
// The vulnerability class allows requests of the form:
//   GET /wp-admin/admin-ajax.php?action=<vulnerable_action>&file=../../../../wp-config.php
// where the `file` parameter is included by the plugin without traversal filtering.

Detection Methods for CVE-2024-34554

Indicators of Compromise

HTTP requests to Stockholm Core plugin endpoints containing ../ or URL-encoded traversal sequences such as %2e%2e%2f
Requests referencing sensitive paths such as wp-config.php, /etc/passwd, or /proc/self/environ
Use of PHP stream wrappers such as php://filter/convert.base64-encode/resource= in query parameters
Unexpected outbound connections from the web server following anomalous plugin requests

Detection Strategies

Inspect web server access logs for authenticated requests to Stockholm Core plugin actions containing traversal patterns
Deploy Web Application Firewall (WAF) signatures for [CWE-22] path traversal targeting WordPress plugin parameters
Correlate low-privileged user sessions with abnormal file access patterns on the underlying host
Alert on PHP process spawning unexpected child processes such as shells or network utilities

Monitoring Recommendations

Enable WordPress audit logging for authenticated user activity, including AJAX and admin-post actions
Monitor filesystem access to wp-config.php and other sensitive files from the web server user
Track plugin version inventory across WordPress installations and alert on Stockholm Core <= 2.4.1
Forward web server and PHP-FPM logs to a centralized SIEM for retention and correlation

How to Mitigate CVE-2024-34554

Immediate Actions Required

Upgrade Stockholm Core to a version later than 2.4.1 as published by Select-Themes
Audit WordPress user accounts and revoke unnecessary low-privileged access
Rotate database credentials and secret keys stored in wp-config.php if exploitation is suspected
Review web server logs for historical requests matching traversal signatures

Patch Information

Select-Themes has addressed the vulnerability in Stockholm Core releases after 2.4.1. Refer to the Patchstack Vulnerability Advisory for fixed version details and vendor guidance. Apply the update through the WordPress plugin manager or by replacing the plugin directory with the patched release.

Workarounds

Restrict access to WordPress authentication surfaces using IP allow-lists where feasible
Deploy a WAF rule blocking ../, ..%2f, and php:// sequences on plugin endpoints
Set PHP open_basedir to confine file inclusion to the WordPress installation directory
Disable the Stockholm Core plugin until patching is complete if the site can tolerate the outage

bash

# Example php.ini hardening to limit file inclusion scope
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off