CVE-2024-3810: Salient Shortcodes WordPress RCE Vulnerability

CVE-2024-3810 Overview

CVE-2024-3810 is a Local File Inclusion (LFI) vulnerability in the Salient Shortcodes plugin for WordPress. The flaw affects all versions up to and including 1.5.3 and resides in the image attribute of the icon shortcode. Authenticated attackers with contributor-level or higher permissions can include and execute arbitrary files on the server. Successful exploitation allows execution of any PHP code contained in those files. Attackers can leverage this to bypass access controls, retrieve sensitive data, or achieve remote code execution when combined with an uploadable PHP file. The vulnerability is tracked under CWE-98: Improper Control of Filename for Include/Require Statement.

Critical Impact
Authenticated contributors can execute arbitrary PHP code on the underlying WordPress server through the vulnerable icon shortcode.

Affected Products

Salient Shortcodes plugin for WordPress (all versions ≤ 1.5.3)
WordPress sites bundling the Salient theme with the Salient Shortcodes plugin
Any WordPress installation granting contributor-level access to untrusted users

Discovery Timeline

2024-05-18 - CVE-2024-3810 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3810

Vulnerability Analysis

The Salient Shortcodes plugin registers an icon shortcode that accepts an image attribute. The plugin passes this attribute value into a PHP file inclusion routine without validating the path or restricting it to a safe directory. An authenticated user with contributor privileges can embed the shortcode in a post and supply an arbitrary local path through the image attribute. When the post renders, WordPress evaluates the shortcode and the plugin includes the referenced file through a PHP include or require construct.

Any PHP contained in the included file executes in the WordPress process context. Attackers can chain this with media upload functionality, log poisoning, or session file writes to convert file inclusion into remote code execution. The bug carries a network attack vector, low complexity, and low privilege requirement, matching typical authenticated LFI-to-RCE patterns in WordPress plugins.

Root Cause

The root cause is improper control of a filename passed to a PHP include statement, classified as CWE-98. The plugin does not sanitize or validate the image shortcode attribute against an allowlist, does not enforce a base directory, and does not restrict the file extension. Attacker-controlled input flows directly into a file inclusion sink.

Attack Vector

An attacker authenticates to WordPress with at least contributor privileges. The attacker creates or edits a post containing the icon shortcode and sets the image attribute to a local path such as an uploaded PHP file, a poisoned log, or a session file. When the post is previewed or rendered, the plugin includes and executes the referenced file. See the Wordfence Vulnerability Report for additional context on the vulnerable shortcode handler.

No verified public exploit code is available. The vulnerability mechanism is described in prose only; refer to the vendor advisory for technical specifics.

Detection Methods for CVE-2024-3810

Indicators of Compromise

Post or page revisions authored by contributor accounts containing [icon ... image="..."] shortcodes with suspicious paths such as ../, absolute filesystem paths, or references to uploads directories.
Unexpected PHP files in wp-content/uploads/ or other writable directories, especially those uploaded shortly before shortcode edits.
Web server access logs showing post preview or render requests immediately following file uploads by contributor-level accounts.
Outbound network connections from the PHP-FPM or Apache worker process to attacker-controlled hosts after post rendering.

Detection Strategies

Inspect the wp_posts and wp_postmeta tables for icon shortcodes containing path traversal sequences or non-standard image paths.
Monitor PHP include, require, include_once, and require_once calls originating from the Salient Shortcodes plugin path using runtime application self-protection or file integrity monitoring.
Correlate contributor-account activity (post creation, media upload) with subsequent PHP process spawns of shells, curl, wget, or python.
Alert on newly created .php files in the uploads directory across all WordPress hosts.

Monitoring Recommendations

Enable WordPress audit logging for post edits, shortcode usage, and role changes for contributor and author accounts.
Forward web server, PHP error, and WordPress audit logs to a central SIEM for correlation across authentication, upload, and rendering events.
Baseline expected shortcode usage on production sites and alert on deviations, particularly image attributes referencing paths outside the media library.

How to Mitigate CVE-2024-3810

Immediate Actions Required

Update the Salient Shortcodes plugin to a version later than 1.5.3 as soon as the vendor releases a patched release.
Audit all contributor, author, editor, and administrator accounts and revoke access for untrusted or dormant users.
Review recent posts and revisions for malicious icon shortcodes and remove any that reference non-media file paths.
Scan the WordPress filesystem for unauthorized PHP files, particularly under wp-content/uploads/.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Site owners should consult the ThemeForest Salient product page and the Wordfence Vulnerability Report for the latest vendor release information and apply the update immediately upon availability.

Workarounds

Deactivate the Salient Shortcodes plugin until a patched version is installed if the icon shortcode is not required.
Restrict contributor-level and above accounts to trusted personnel only; the vulnerability requires authenticated access to exploit.
Deploy a Web Application Firewall rule that blocks shortcode attributes containing path traversal sequences or absolute filesystem paths in POST bodies to wp-admin/post.php and wp-admin/post-new.php.
Configure PHP open_basedir and disable_functions to constrain the WordPress process and limit the blast radius of file inclusion.
Prevent PHP execution in the uploads directory by adding a directory-level web server rule that denies .php handling under wp-content/uploads/.

bash

# Nginx: block PHP execution inside the WordPress uploads directory
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}

# Apache (.htaccess in wp-content/uploads/): disable PHP handlers
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>