CVE-2024-37410: Powerpack For Beaver Builder RCE Flaw

CVE-2024-37410 Overview

CVE-2024-37410 is a PHP Remote File Inclusion (RFI) vulnerability in the IdeaBox Creations PowerPack Lite for Beaver Builder WordPress plugin. The flaw affects all versions up to and including 1.3.0.3. Patchstack classifies the underlying weakness as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. An authenticated attacker with high privileges can influence the filename used by an include or require statement, leading to loading of attacker-controlled PHP code within the WordPress process. Successful exploitation compromises confidentiality, integrity, and availability of the target site.

Critical Impact
Authenticated exploitation allows arbitrary PHP file inclusion inside the WordPress process, enabling code execution, credential theft, and full site takeover.

Affected Products

IdeaBox Creations PowerPack Lite for Beaver Builder plugin for WordPress
All versions from initial release through 1.3.0.3
WordPress sites using the powerpack-addon-for-beaver-builder package

Discovery Timeline

2024-07-09 - CVE-2024-37410 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37410

Vulnerability Analysis

The vulnerability resides in a code path where PowerPack Lite for Beaver Builder passes user-influenced input to a PHP include or require statement without sufficient validation. Because the target parameter is not restricted to an allowlist of local template files, an attacker can direct the include statement to a file of their choosing. According to the Patchstack advisory, the issue is classified as a Local File Inclusion, but the underlying weakness (CWE-98) also allows remote inclusion when PHP configuration and the plugin logic permit external paths.

Exploitation requires an authenticated session with high privileges, which typically maps to a WordPress administrator or comparable role capable of interacting with the plugin's backend. Once triggered, the include statement executes arbitrary PHP inside the site process, granting the attacker the same privileges as the web server user.

Root Cause

The root cause is improper control of the filename argument supplied to a PHP file inclusion function. The plugin does not enforce an allowlist, sanitize path separators, or normalize the resolved path before passing it to include/require. Any attacker-controlled string that resolves to a readable PHP file becomes executable server-side.

Attack Vector

The attack vector is network-based. An attacker with valid high-privilege credentials sends a crafted HTTP request to the vulnerable plugin endpoint, supplying a manipulated filename parameter. The request causes PHP to load and execute the referenced file, either from disk (LFI) or from an attacker-controlled location if remote include is enabled. No user interaction is required beyond the attacker's own authenticated request.

See the Patchstack Vulnerability Analysis for the specific parameter and endpoint details.

Detection Methods for CVE-2024-37410

Indicators of Compromise

Unexpected PHP files written under wp-content/uploads/ or plugin directories, particularly files with obfuscated or random names.
Web server access logs containing requests to PowerPack Lite endpoints with parameters holding path traversal sequences such as ../, absolute paths, or php:// and data:// wrappers.
Outbound HTTP requests from the web server to unfamiliar hosts immediately after administrator activity.
New or modified WordPress administrator accounts and unexplained changes to wp-config.php or .htaccess.

Detection Strategies

Inspect access logs for requests targeting the powerpack-addon-for-beaver-builder plugin containing suspicious file, template, or path-like parameters.
Use file integrity monitoring on the WordPress installation to flag new PHP files, especially those outside expected plugin and theme directories.
Enable and review PHP error logs for include/require warnings referencing unexpected paths.

Monitoring Recommendations

Track authentication events for administrator accounts, focusing on unusual source IPs, geolocations, or session times.
Alert on egress traffic from the web server that does not match known WordPress update or plugin endpoints.
Correlate WordPress audit logs with web server logs to identify plugin actions that precede file writes or configuration changes.

How to Mitigate CVE-2024-37410

Immediate Actions Required

Update PowerPack Lite for Beaver Builder to a version later than 1.3.0.3 as soon as the vendor publishes a fixed release.
Rotate all WordPress administrator passwords and invalidate active sessions on affected sites.
Audit the WordPress installation for unauthorized PHP files, users, scheduled tasks (wp-cron), and modified core files.

Patch Information

Refer to the Patchstack WordPress Vulnerability Report for the current patch status and remediation guidance. At the time of publication, the advisory identifies 1.3.0.3 as the last confirmed vulnerable version. Site operators should track the plugin's changelog for a version that addresses CWE-98 in the affected include path.

Workarounds

Deactivate and remove PowerPack Lite for Beaver Builder until a patched release is installed.
Restrict administrator access using IP allowlisting on /wp-admin/ and enforce multi-factor authentication for all privileged accounts.
Set allow_url_include=Off and allow_url_fopen=Off in php.ini to block remote include vectors, and use open_basedir to constrain filesystem access.
Deploy a web application firewall rule that blocks requests to the plugin containing path traversal patterns or PHP stream wrappers.

bash

# Harden PHP against remote file inclusion (php.ini)
allow_url_include = Off
allow_url_fopen = Off
open_basedir = /var/www/html:/tmp

# Temporary WordPress mitigation via WP-CLI
wp plugin deactivate powerpack-addon-for-beaver-builder
wp plugin delete powerpack-addon-for-beaver-builder