CVE-2024-37092: Consulting Elementor Widgets Path Traversal

CVE-2024-37092 Overview

CVE-2024-37092 is a path traversal vulnerability [CWE-22] in the StylemixThemes Consulting Elementor Widgets plugin for WordPress. The flaw permits PHP Local File Inclusion (LFI) through improper limitation of a pathname to a restricted directory. Attackers with low-privilege authenticated access can traverse the filesystem and include arbitrary PHP files. The vulnerability affects all plugin versions up to and including 1.3.0. Successful exploitation impacts confidentiality, integrity, and availability of the WordPress host.

Critical Impact
Authenticated attackers can include and execute arbitrary local PHP files on the server, leading to remote code execution and full site compromise.

Affected Products

StylemixThemes Consulting Elementor Widgets versions through 1.3.0
WordPress installations running the vulnerable plugin
Sites using the plugin with any authenticated user role capable of triggering the vulnerable code path

Discovery Timeline

2024-06-24 - CVE-2024-37092 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37092

Vulnerability Analysis

The plugin fails to validate and sanitize user-supplied input used to construct file paths. An attacker submits crafted input containing directory traversal sequences such as ../ to escape the intended directory. The application resolves the manipulated path and passes it to a PHP file inclusion function like include or require. PHP then loads and executes the referenced file within the plugin's execution context.

Because the inclusion executes PHP code, an attacker who can write controllable content to a file on disk can escalate the LFI to remote code execution. Typical escalation paths involve log poisoning, session file inclusion, or uploading benign-looking files whose contents contain PHP payloads. The EPSS score of 0.525% (42nd percentile) reflects moderate near-term exploitation likelihood for internet-exposed WordPress sites.

Root Cause

The root cause is missing input validation on a parameter that flows into a filesystem path used by a PHP inclusion function. The plugin does not enforce an allowlist of valid template or view names. It also fails to canonicalize the resulting path before use, allowing traversal sequences to reach parent directories outside the plugin's intended scope.

Attack Vector

The attack is network-reachable and requires low privileges but no user interaction. An authenticated attacker sends an HTTP request to the vulnerable endpoint with a manipulated file parameter. The request is processed server-side, and the traversed path is included by PHP. See the Patchstack Vulnerability Report for technical details.

// No verified public proof-of-concept is available.
// The vulnerability class permits requests of the form:
//   POST /wp-admin/admin-ajax.php?action=<vulnerable_action>&file=../../../../wp-config.php
// resulting in inclusion of files outside the plugin directory.

Detection Methods for CVE-2024-37092

Indicators of Compromise

HTTP requests to WordPress admin-ajax or plugin endpoints containing ../, ..%2f, or URL-encoded traversal sequences in file or template parameters
Unexpected PHP include, require, or file_get_contents operations targeting paths outside wp-content/plugins/consulting-elementor-widgets/
Access patterns reading sensitive files such as wp-config.php, /etc/passwd, or PHP session files from web request contexts
New or modified PHP files in upload directories following inclusion attempts

Detection Strategies

Inspect web server and WordPress access logs for authenticated requests containing traversal sequences targeting plugin parameters
Deploy web application firewall rules that flag directory traversal patterns in query strings and POST bodies
Correlate low-privilege user sessions with anomalous file read patterns on the underlying host

Monitoring Recommendations

Alert on PHP process file access outside expected plugin and theme directories
Monitor for spikes in 200-status responses to WordPress AJAX endpoints from subscriber-level accounts
Track newly created PHP files in wp-content/uploads/ and other writable directories

How to Mitigate CVE-2024-37092

Immediate Actions Required

Upgrade Consulting Elementor Widgets to a version later than 1.3.0 as soon as the vendor publishes a fix
Audit WordPress user accounts and revoke unnecessary authenticated access
Review web server logs for prior exploitation attempts targeting the plugin

Patch Information

No fixed version is listed in the NVD entry. Refer to the Patchstack Vulnerability Report for current patch availability and vendor guidance.

Workarounds

Deactivate and remove the Consulting Elementor Widgets plugin until a patched release is confirmed
Restrict PHP execution in wp-content/uploads/ through web server configuration to limit escalation paths
Apply WAF signatures that block directory traversal sequences in requests to WordPress endpoints
Enforce least privilege on WordPress roles to reduce the pool of accounts that can reach the vulnerable code path

bash

# Example nginx rule to block traversal sequences targeting the plugin
location ~* /wp-content/plugins/consulting-elementor-widgets/ {
    if ($args ~* "\.\./|\.\.%2f|%2e%2e%2f") {
        return 403;
    }
}