CVE-2024-37423: Newspack Blocks Path Traversal Flaw

CVE-2024-37423 Overview

CVE-2024-37423 is a path traversal vulnerability in the Automattic Newspack Blocks plugin for WordPress. The flaw affects all versions up to and including 3.0.8. It allows an authenticated attacker with Contributor-level privileges to delete arbitrary directories on the server through improper limitation of a pathname to a restricted directory [CWE-22].

The vulnerability is tracked under the Common Weakness Enumeration category CWE-22 (Path Traversal). The scope is marked as changed, meaning the impact extends beyond the vulnerable component to affect other resources on the host.

Critical Impact
An authenticated contributor can traverse the filesystem and delete arbitrary directories, potentially disrupting the WordPress installation or the underlying host and causing availability loss.

Affected Products

Automattic Newspack Blocks plugin for WordPress
All versions from initial release through 3.0.8
WordPress sites running the Newspack Blocks plugin with contributor accounts enabled

Discovery Timeline

2024-11-01 - CVE-2024-37423 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37423

Vulnerability Analysis

The vulnerability resides in the Newspack Blocks plugin, an editorial extension developed by Automattic for WordPress publishers. The plugin exposes functionality that accepts a user-controlled path parameter without properly restricting it to an intended base directory.

A contributor authenticated to the WordPress site can supply crafted input containing directory traversal sequences such as ../. The plugin resolves the manipulated path and performs a directory deletion operation outside the intended scope. This produces arbitrary directory removal on the underlying filesystem.

Because the CVSS scope is changed and the impact focuses on availability, the primary consequence is destruction of directory contents. Loss of directories under the WordPress root, plugin directories, or upload folders can render the site inoperable and cause data loss.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The plugin trusts input passed to a filesystem operation without canonicalizing the resolved path and verifying it stays within an allowlisted base directory.

Attack Vector

The attack is network-based and requires low privileges. An attacker needs a Contributor account on the target WordPress site. No user interaction is required. The attacker submits a request to the vulnerable Newspack Blocks endpoint with a path parameter containing traversal sequences. The plugin then deletes the resolved directory on the host filesystem.

For technical details, see the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2024-37423

Indicators of Compromise

Unexpected deletion of directories under the WordPress installation, wp-content/uploads, or plugin folders
Web server access logs showing authenticated Contributor requests to Newspack Blocks endpoints containing ../ or URL-encoded traversal sequences such as %2e%2e%2f
WordPress error logs referencing missing files or directories after contributor activity

Detection Strategies

Inspect HTTP request bodies and query parameters sent to Newspack Blocks REST endpoints for path traversal patterns
Correlate contributor user session activity with filesystem change events on the web server
Alert on unexpected unlink, rmdir, or recursive delete syscalls originating from the PHP worker process

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root, plugin directories, and upload paths
Forward web server access logs and PHP-FPM audit trails to a centralized SIEM for correlation
Track Newspack Blocks plugin version across all managed WordPress sites and alert on hosts still running 3.0.8 or earlier

How to Mitigate CVE-2024-37423

Immediate Actions Required

Update the Newspack Blocks plugin to a version later than 3.0.8 as soon as a fixed release is available from Automattic
Audit contributor accounts and remove or downgrade any accounts that are not strictly required
Review filesystem state and restore missing directories from backup if arbitrary deletion is suspected

Patch Information

Refer to the Patchstack Vulnerability Advisory for the current fixed version guidance. Apply the vendor patch through the WordPress plugin update mechanism.

Workarounds

Temporarily disable the Newspack Blocks plugin on sites where an upgrade cannot be applied immediately
Restrict Contributor role capabilities using a role management plugin to block access to affected endpoints
Deploy a web application firewall rule that blocks requests containing path traversal sequences to Newspack Blocks routes

bash

# Example WAF rule (ModSecurity syntax) to block traversal on Newspack Blocks endpoints
SecRule REQUEST_URI "@contains /wp-json/newspack-blocks/" \
  "chain,id:1004237423,phase:2,deny,status:403,log,msg:'CVE-2024-37423 traversal attempt'"
  SecRule ARGS|REQUEST_BODY "@rx (\.\./|%2e%2e%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"