CVE-2024-37108: WishList Member X Path Traversal Flaw

CVE-2024-37108 Overview

CVE-2024-37108 is a path traversal vulnerability [CWE-22] affecting the WishList Products WishList Member X plugin for WordPress. The flaw impacts all versions up to and including 3.26.6. An authenticated attacker with low privileges can traverse directories outside the intended path and delete arbitrary files on the server. Successful exploitation disrupts site availability and can lead to full site compromise when critical files such as wp-config.php are removed, forcing WordPress into a setup state that attackers can hijack.

Critical Impact
Authenticated attackers can delete arbitrary files on the WordPress host, enabling denial of service and potential site takeover through configuration reset attacks.

Affected Products

WishList Products WishList Member X (WordPress plugin)
All versions from n/a through 3.26.6
WordPress sites with the plugin installed and active

Discovery Timeline

2024-11-01 - CVE-2024-37108 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37108

Vulnerability Analysis

The vulnerability stems from improper limitation of a pathname to a restricted directory within WishList Member X. The plugin accepts a user-supplied file path parameter and passes it to a file deletion routine without adequately validating or canonicalizing the input. Authenticated users can supply traversal sequences such as ../ to escape the intended directory and target arbitrary files on the underlying filesystem.

The issue is classified as an authenticated arbitrary file deletion vulnerability. Because the plugin runs within the WordPress process context, deletions execute with the privileges of the PHP-FPM or web server user. This access is typically sufficient to remove any file within the WordPress installation, including core files, plugin assets, and configuration files.

Root Cause

The root cause is missing input validation on a file path parameter processed by an authenticated plugin endpoint. The vulnerable handler does not enforce a base directory restriction, does not resolve the canonical path before performing operations, and does not verify that the target file belongs to a permitted location. Refer to the Patchstack CVE Analysis for detailed technical context.

Attack Vector

Exploitation requires an authenticated session with low-level privileges on the target WordPress site. The attacker sends an HTTP request to the vulnerable plugin endpoint with a filename or path parameter containing directory traversal sequences. The server processes the request, resolves the traversed path, and invokes unlink() or an equivalent deletion function on the target file. Deleting wp-config.php places WordPress into installation mode, which an unauthenticated attacker can then abuse to reconfigure the database connection and gain administrative control.

Detection Methods for CVE-2024-37108

Indicators of Compromise

HTTP requests to WishList Member X plugin endpoints containing ../ or URL-encoded traversal patterns such as %2e%2e%2f in path or filename parameters
Unexpected deletion of WordPress core files, wp-config.php, .htaccess, or plugin files
WordPress unexpectedly displaying the initial setup or database configuration screen
Web server error logs referencing missing files that existed prior to authenticated plugin activity

Detection Strategies

Inspect access logs for POST or GET requests to WishList Member X administrative endpoints that include path traversal payloads in parameters
Correlate authenticated WordPress user actions with filesystem deletion events using file integrity monitoring
Deploy web application firewall rules that identify traversal sequences in request bodies and query strings targeting /wp-admin/admin-ajax.php or plugin routes

Monitoring Recommendations

Enable file integrity monitoring on wp-config.php, WordPress core directories, and plugin folders to alert on unauthorized deletions
Log all authenticated plugin actions with the associated user ID, IP address, and full request parameters
Alert on any HTTP 200 response to requests containing traversal sequences directed at the WishList Member X plugin

How to Mitigate CVE-2024-37108

Immediate Actions Required

Update WishList Member X to a version later than 3.26.6 that addresses this path traversal vulnerability
Audit WordPress user accounts and revoke unnecessary low-privilege access until the plugin is patched
Verify the integrity of wp-config.php and critical WordPress files, restoring from backup if tampering is detected

Patch Information

WishList Products has released a fixed version of WishList Member X addressing the arbitrary file deletion flaw. Site administrators should apply the vendor update through the WordPress plugin manager. Consult the Patchstack CVE Analysis for version-specific patch details.

Workarounds

Deploy a web application firewall rule blocking traversal sequences (../, %2e%2e%2f, ..\\) in requests to the plugin
Restrict filesystem permissions so the web server user cannot delete wp-config.php or files outside the uploads directory
Temporarily deactivate the WishList Member X plugin until the update is applied on production sites

bash

# Example WAF rule (ModSecurity) blocking traversal on plugin endpoints
SecRule REQUEST_URI "@contains wishlist-member" \
  "chain,phase:2,deny,status:403,id:1002024,msg:'CVE-2024-37108 traversal attempt'"
  SecRule ARGS "@rx (\.\./|%2e%2e%2f|\.\.\\\\)" "t:lowercase,t:urlDecodeUni"