CVE-2024-37520: Radiustheme Shopbuilder RCE Vulnerability

CVE-2024-37520 Overview

CVE-2024-37520 is a PHP Remote File Inclusion vulnerability affecting the RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons plugin for WordPress. The flaw stems from improper control of a filename used in an include/require statement [CWE-98]. Authenticated attackers with low privileges can leverage this weakness to include and execute attacker-controlled files on the server. All versions of radiustheme/shopbuilder up to and including 2.1.12 are affected. The vulnerability enables remote code execution over the network with low attack complexity, exposing WordPress deployments to full site compromise.

Critical Impact
Authenticated attackers can execute arbitrary PHP code on vulnerable WordPress sites, leading to full site takeover and lateral movement into the underlying server.

Affected Products

RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons versions up to and including 2.1.12
WordPress installations using the vulnerable shopbuilder plugin
WooCommerce storefronts built on Elementor with the affected plugin enabled

Discovery Timeline

2024-07-09 - CVE-2024-37520 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37520

Vulnerability Analysis

The ShopBuilder plugin passes user-controlled input into a PHP include or require statement without adequate validation or allow-listing. This behavior maps to CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program. Attackers can manipulate the filename parameter to load arbitrary PHP files that the web server can reach. When paired with a writable path such as an uploads directory, this results in remote code execution under the WordPress process account. The impact extends to confidentiality, integrity, and availability of the affected site and any resources accessible to the PHP runtime.

Root Cause

The plugin constructs file paths from request parameters and passes them directly to a PHP file-inclusion primitive. Missing input sanitization, path canonicalization, and an absence of a strict allow-list of includable templates allow attacker-controlled values to reach the include sink. Traversal sequences and absolute paths are not filtered, enabling access to files outside the intended template directory.

Attack Vector

Exploitation requires authentication with low-privilege credentials, such as a subscriber or contributor account. The attacker submits a crafted HTTP request that supplies a manipulated filename parameter to the vulnerable endpoint. The server includes and executes the attacker-referenced PHP file, giving the attacker code execution in the WordPress context. See the Patchstack WordPress Plugin Vulnerability entry for the plugin-specific details.

No verified public exploit code is available. Refer to the Patchstack Local File Inclusion Risk advisory for further technical context.

Detection Methods for CVE-2024-37520

Indicators of Compromise

HTTP requests to WordPress admin-ajax.php or ShopBuilder endpoints containing path traversal sequences such as ../ or absolute file paths in template or file parameters
Unexpected PHP files created under wp-content/uploads/ or plugin directories following authenticated requests
New or modified administrator accounts and unscheduled wp-cron entries after ShopBuilder activity
Outbound connections from the web server to attacker-controlled infrastructure originating from PHP worker processes

Detection Strategies

Inspect web server and WordPress access logs for parameters referencing filenames, especially those containing traversal characters or .php payloads submitted by low-privilege users
Correlate authenticated ShopBuilder requests with subsequent file writes or process launches under the web server user
Deploy WordPress-aware WAF rules that flag file-inclusion patterns targeting the shopbuilder plugin routes

Monitoring Recommendations

Enable file integrity monitoring on wp-content/plugins/shopbuilder/ and wp-content/uploads/ to catch unauthorized additions
Alert on PHP interpreter spawning shell utilities such as sh, bash, curl, or wget
Aggregate WordPress audit logs and web server logs centrally to identify authenticated exploitation attempts across sites

How to Mitigate CVE-2024-37520

Immediate Actions Required

Update the ShopBuilder – Elementor WooCommerce Builder Addons plugin to a version later than 2.1.12 as soon as a fixed release is available from RadiusTheme
Audit WordPress user accounts and revoke or reset credentials for low-privilege users that are not strictly required
Restrict access to wp-admin and AJAX endpoints by IP allow-list where feasible
Review the web server for unfamiliar PHP files, cron entries, and administrator accounts created since the plugin was installed

Patch Information

Refer to the Patchstack WordPress Plugin Vulnerability entry for the current patch status. Sites running shopbuilder2.1.12 or earlier must upgrade to a remediated release from RadiusTheme. If no patched version is available, deactivate and remove the plugin until a fix is released.

Workarounds

Deactivate the ShopBuilder plugin until a fixed version is installed
Configure a WAF rule to block requests to ShopBuilder endpoints containing ../, absolute paths, or .php values in filename parameters
Set PHP open_basedir and disable_functions directives to constrain file inclusion and process execution capabilities of the WordPress process
Enforce least-privilege roles and disable open user registration on sites that do not require it

bash

# Example WAF rule (ModSecurity) to block traversal in ShopBuilder parameters
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1004037520,\
   msg:'Potential CVE-2024-37520 ShopBuilder LFI attempt'"
  SecRule ARGS "@rx (\.\./|\.\.\\|/etc/|\.php$)" "t:none,t:urlDecodeUni"