CVE-2024-37454: AWSM Team Path Traversal Vulnerability

CVE-2024-37454 Overview

CVE-2024-37454 is a path traversal vulnerability [CWE-22] in the AWSM Team WordPress plugin developed by AWSM Innovations. The flaw affects all versions up to and including 1.3.1 and enables authenticated attackers to include arbitrary local files through improper limitation of a pathname to a restricted directory. Patchstack classifies the underlying issue as a local file inclusion (LFI) vulnerability. Successful exploitation can lead to sensitive information disclosure, execution of injected code, and full compromise of the WordPress site.

Critical Impact

Authenticated attackers can traverse directories to include local files, potentially leading to remote code execution and full site compromise on affected WordPress installations.

Affected Products

• AWSM Innovations AWSM Team (Team Showcase Plugin) for WordPress
• All versions from n/a through 1.3.1
• WordPress sites running the vulnerable plugin

Discovery Timeline

• 2024-07-09 - CVE-2024-37454 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37454

Vulnerability Analysis

The vulnerability resides in the AWSM Team plugin's file handling logic, where user-supplied input reaches file inclusion routines without proper sanitization or canonicalization. Attackers holding low-privilege authenticated accounts can supply traversal sequences such as ../ to escape the intended directory and reference files elsewhere on the server. Patchstack documents the issue as a local file inclusion flaw in the Team Showcase Plugin through version 1.3.1.

The attack executes over the network with low complexity and requires only low-level privileges. It results in high impact to confidentiality, integrity, and availability. Successful inclusion of attacker-controlled or attacker-writable files can escalate the primitive to arbitrary code execution within the PHP process running WordPress.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The plugin accepts a file path parameter and passes it to a PHP include or read function without validating that the resolved path remains within an allowed base directory. Missing normalization of ../ sequences and absent allowlisting of permitted filenames enable directory traversal.

Attack Vector

An authenticated attacker sends a crafted HTTP request to a vulnerable plugin endpoint with a manipulated file path parameter. The request traverses the WordPress installation directory to reach sensitive files such as wp-config.php, system configuration files, or attacker-uploaded content. When combined with a file upload vector or log poisoning, the traversal primitive can be chained to achieve remote code execution.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-37454

Indicators of Compromise

• HTTP requests to AWSM Team plugin endpoints containing directory traversal sequences such as ../, ..%2f, or ..%252f in query or POST parameters.
• Web server access to sensitive files including wp-config.php, /etc/passwd, or PHP session files originating from plugin request handlers.
• Unexpected PHP include, require, or file_get_contents calls resolving outside the plugin directory in application logs.

Detection Strategies

• Inspect WordPress access logs for requests targeting AWSM Team plugin routes with encoded or literal path traversal payloads.
• Deploy web application firewall rules that identify traversal patterns and null-byte injection against WordPress plugin URLs.
• Monitor file integrity on WordPress installations to detect unauthorized reads or writes to core configuration files.

Monitoring Recommendations

• Enable verbose PHP error logging to capture failed file inclusion attempts referencing paths outside the web root.
• Alert on authenticated sessions issuing anomalous parameter values to plugin endpoints, especially from IP addresses with no prior editorial activity.
• Correlate WordPress user login events with subsequent plugin traffic to identify credential misuse preceding exploitation attempts.

How to Mitigate CVE-2024-37454

Immediate Actions Required

• Disable or deactivate the AWSM Team plugin on all WordPress sites until a patched release is confirmed installed.
• Audit WordPress user accounts and rotate credentials for any low-privilege accounts that could be leveraged to reach vulnerable endpoints.
• Review server logs for prior exploitation attempts and inspect wp-config.php for signs of unauthorized disclosure of database credentials or authentication secrets.

Patch Information

The advisory in the Patchstack Vulnerability Report tracks the vulnerability through version 1.3.1. Administrators should upgrade to a version later than 1.3.1 as soon as one is published by AWSM Innovations and validated against this CVE.

Workarounds

• Restrict access to WordPress administrative and plugin endpoints using IP allowlisting or authentication proxies until patching is complete.
• Configure a web application firewall to block requests containing ../, URL-encoded traversal sequences, or absolute paths targeting plugin parameters.
• Enforce least-privilege roles in WordPress so that fewer accounts hold the authentication level required to reach the vulnerable functionality.

# Example WAF rule pattern to block traversal against the plugin
# ModSecurity rule illustrating parameter inspection
SecRule ARGS "@rx (\.\./|\.\.%2f|\.\.%252f)" \
    "id:1004374,phase:2,deny,status:403,\
     msg:'Path traversal attempt against AWSM Team plugin (CVE-2024-37454)'"