CVE-2024-35778: Slideshow SE Path Traversal Vulnerability

CVE-2024-35778 Overview

CVE-2024-35778 is a path traversal vulnerability in the Slideshow SE plugin for WordPress, developed by John West. The flaw allows an authenticated user with author-level privileges to include arbitrary local files on the server through the plugin's PHP handling. The issue affects Slideshow SE versions from an unspecified initial release through 2.5.17. It is classified under CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated authors can read sensitive server files and potentially achieve code execution through Local File Inclusion, compromising confidentiality, integrity, and availability of the WordPress installation.

Affected Products

Slideshow SE WordPress plugin versions up to and including 2.5.17
WordPress sites running the vulnerable Slideshow SE plugin
Any hosting environment exposing the plugin to author-level accounts

Discovery Timeline

2024-06-21 - CVE-2024-35778 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35778

Vulnerability Analysis

The Slideshow SE plugin fails to properly sanitize file path parameters supplied through authenticated requests. An attacker holding an author-level WordPress account can supply directory traversal sequences to reference files outside the intended plugin directory. The plugin then loads the specified path via a PHP inclusion mechanism, resulting in Local File Inclusion (LFI). Because the attack occurs over the network with low complexity and requires only low privileges, the vulnerability produces high impact against confidentiality, integrity, and availability. The EPSS probability reported for this issue is 0.567%.

Root Cause

The root cause is improper input validation on file path parameters passed to a PHP include or require statement inside the plugin. The plugin does not restrict paths to an allow-listed directory and does not strip traversal sequences such as ../. This allows resolution of arbitrary filesystem paths accessible to the PHP process running WordPress.

Attack Vector

Exploitation requires an authenticated session with at least author-level privileges within WordPress. The attacker submits a crafted request to a Slideshow SE endpoint containing a path traversal payload in a filename parameter. The plugin resolves the path and includes the target file, exposing content such as wp-config.php, system configuration files, or log data. If an attacker can write PHP content to a known location on disk, for example uploaded media metadata or logs, LFI can escalate to remote code execution.

See the Patchstack Vulnerability Advisory for additional technical detail.

Detection Methods for CVE-2024-35778

Indicators of Compromise

Web server access logs showing requests to Slideshow SE endpoints containing ../ or URL-encoded %2e%2e%2f sequences
Author-account requests referencing sensitive paths such as wp-config.php, /etc/passwd, or /proc/self/environ
Unexpected PHP include or require warnings in error logs referencing paths outside the plugin directory
WordPress author accounts created shortly before anomalous plugin requests

Detection Strategies

Inspect HTTP request parameters targeting /wp-content/plugins/slideshow-se/ for traversal patterns and decode multiple layers of encoding before matching
Correlate authenticated author sessions with file access patterns that deviate from normal plugin usage
Alert on PHP process reads of files outside the WordPress document root originating from the web server user

Monitoring Recommendations

Forward WordPress, PHP, and web server logs to a centralized analytics platform for query and correlation
Track creation and privilege changes on WordPress author accounts across managed sites
Monitor plugin version inventory to identify hosts still running Slideshow SE 2.5.17 or earlier

How to Mitigate CVE-2024-35778

Immediate Actions Required

Update Slideshow SE to a version released after 2.5.17 that addresses CWE-22
Audit WordPress user accounts and remove or downgrade unused author-level accounts
Rotate credentials and secrets stored in wp-config.php if exploitation is suspected
Review web server and PHP logs for traversal indicators dating back to plugin installation

Patch Information

Refer to the Patchstack Vulnerability Advisory for the fixed version. Apply the vendor update through the WordPress plugin manager or replace the plugin files manually on the affected host.

Workarounds

Deactivate and remove the Slideshow SE plugin until a patched version can be installed
Restrict author-level account creation and enforce strong authentication with multi-factor authentication
Deploy a web application firewall rule to block traversal sequences in requests targeting the plugin path
Set the PHP open_basedir directive to constrain file access to the WordPress installation directory

bash

# Example php.ini restriction to limit file inclusion scope
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"