CVE-2024-35745: Strategery Migrations Path Traversal Flaw

CVE-2024-35745 Overview

CVE-2024-35745 is a path traversal vulnerability [CWE-22] in the Strategery Migrations WordPress plugin developed by Gabriel Somoza and Joseph Fitzgibbons. The flaw affects all versions of Strategery Migrations up to and including 1.0. Attackers can exploit improper limitation of a pathname to a restricted directory to perform arbitrary file deletion on affected WordPress installations. Exploitation requires no authentication, no user interaction, and can be performed over the network. The Patchstack advisory categorizes this issue as an arbitrary file deletion vulnerability, which can lead to loss of critical WordPress files and disruption of site availability.

Critical Impact
Unauthenticated attackers can traverse directories and delete arbitrary files on WordPress servers running Strategery Migrations 1.0 or earlier.

Affected Products

Strategery Migrations WordPress plugin — all versions through 1.0
WordPress sites with the plugin installed and active
Deployments where the plugin endpoint is reachable from the network

Discovery Timeline

2024-06-10 - CVE-2024-35745 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35745

Vulnerability Analysis

The vulnerability stems from insufficient validation of user-supplied file path parameters within the Strategery Migrations plugin. The plugin accepts pathname input intended to reference migration-related files but fails to restrict the path to an allowed directory. Attackers submit path traversal sequences such as ../ to escape the intended directory. The plugin then operates on files outside its scope, enabling file manipulation and deletion across the WordPress installation.

The Patchstack advisory identifies the outcome as arbitrary file deletion. Deleting files such as wp-config.php can force WordPress into a setup state, which attackers can leverage to reconfigure the site against an attacker-controlled database. This transforms a file deletion primitive into a pathway to full site compromise.

Root Cause

The plugin does not canonicalize or validate file path parameters before passing them to file system operations. There is no allowlist of permitted directories, no rejection of traversal sequences, and no verification that the resolved path stays within the plugin's working directory. This is a textbook CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to a vulnerable plugin endpoint. The request includes a file parameter containing directory traversal sequences pointing to a target file on the WordPress host. The plugin resolves the path and performs a file operation, deleting the referenced file. No credentials, tokens, or user interaction are required.

See the Patchstack Arbitrary File Deletion Advisory for the technical write-up.

Detection Methods for CVE-2024-35745

Indicators of Compromise

HTTP requests to Strategery Migrations plugin endpoints containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f
Unexpected disappearance of WordPress core files including wp-config.php, .htaccess, or theme and plugin files
WordPress installation redirecting to the setup wizard (/wp-admin/setup-config.php) without administrator action
Web server error log entries referencing missing files that previously existed

Detection Strategies

Inspect access logs for requests targeting /wp-content/plugins/strategery-migrations/ containing traversal patterns or suspicious file parameters
Deploy file integrity monitoring on WordPress document roots to alert on unexpected deletions
Enable WAF rules that block path traversal payloads in query strings and request bodies directed at WordPress endpoints

Monitoring Recommendations

Aggregate WordPress access logs and correlate DELETE-like file operations with plugin request patterns
Alert on transitions to WordPress setup state, which indicate wp-config.php removal
Track plugin inventory across managed WordPress sites to identify hosts still running Strategery Migrations 1.0

How to Mitigate CVE-2024-35745

Immediate Actions Required

Deactivate and remove the Strategery Migrations plugin from all WordPress installations until a patched version is confirmed
Restrict access to /wp-content/plugins/strategery-migrations/ at the web server or WAF layer
Back up wp-config.php and other critical files, and verify file integrity across the document root
Rotate database credentials and WordPress salts if compromise is suspected

Patch Information

The Patchstack advisory lists affected versions from n/a through 1.0 without confirming a fixed release. Administrators should consult the Patchstack Arbitrary File Deletion Advisory for the latest remediation status and remove the plugin if no fixed version is available.

Workarounds

Uninstall the plugin entirely if it is not required for site operations
Apply WAF rules that reject requests containing ../, ..\, or encoded traversal sequences to plugin endpoints
Enforce least-privilege file system permissions so the PHP process cannot delete WordPress core files

bash

# Example NGINX rule blocking traversal requests to the vulnerable plugin path
location ~* /wp-content/plugins/strategery-migrations/ {
    if ($args ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
}