CVE-2024-3813: Tagdiv Composer RCE Vulnerability

CVE-2024-3813 Overview

CVE-2024-3813 is a Local File Inclusion (LFI) vulnerability in the tagDiv Composer plugin for WordPress. The flaw affects all versions up to and including 4.8 and resides in the td_block_title shortcode's block_template_id attribute. Authenticated attackers with contributor-level or higher permissions can include and execute arbitrary files on the server, resulting in PHP code execution. The vulnerability maps to [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Authenticated contributors can execute arbitrary PHP code, bypass access controls, exfiltrate sensitive data, and pivot to full site compromise where PHP files can be uploaded and included.

Affected Products

tagDiv Composer plugin for WordPress, all versions through 4.8
WordPress sites that permit contributor-or-higher registration alongside the plugin
Multisite WordPress deployments running the vulnerable plugin

Discovery Timeline

2024-06-15 - CVE-2024-3813 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3813

Vulnerability Analysis

The tagDiv Composer plugin registers a shortcode named td_block_title that accepts a block_template_id attribute. The plugin passes this attribute into a PHP include/require statement without adequate validation or path normalization. An authenticated user rendering a shortcode with a controlled block_template_id value can force the server to load an arbitrary file from the filesystem. When that file contains PHP, the server executes it in the context of the WordPress worker process.

Exploitation only requires contributor-level access, which is often granted through open registration or guest-author workflows. Because the shortcode is processed during normal post preview or rendering, the attacker does not need to publish the post to trigger inclusion.

Root Cause

The root cause is unsanitized user-supplied input flowing into a PHP file inclusion statement [CWE-98]. The plugin fails to constrain block_template_id to an allow-list of expected template identifiers and does not strip directory traversal sequences before resolving the path.

Attack Vector

The attack vector is network-based and requires authenticated access. An attacker with a contributor account crafts a post or preview payload that embeds the td_block_title shortcode with a malicious block_template_id value. The value references a local file, either a legitimate PHP file abused for logic, an uploaded media file with PHP content, or a log or session file poisoned with attacker-controlled data. Rendering the shortcode includes and executes that file. See the Wordfence Vulnerability Report ID 87b7bc4a for additional technical context and the TagDiv Composer Basics Guide for shortcode background.

Detection Methods for CVE-2024-3813

Indicators of Compromise

Post revisions, drafts, or shortcodes containing td_block_title with a block_template_id value pointing at absolute paths, traversal sequences (../), or non-template files
New or modified PHP files in wp-content/uploads/ or other writable directories that should not contain executable code
Unexpected outbound network connections or shell processes spawned from the PHP-FPM or web server worker
Recently created contributor, author, or subscriber accounts followed by shortcode-rendering activity

Detection Strategies

Search the wp_posts and wp_postmeta tables for shortcode content matching td_block_title with suspicious block_template_id values
Monitor PHP include/require errors in web server logs referencing paths outside the plugin's template directory
Correlate low-privileged user logins with post preview requests to admin-ajax.php or REST endpoints handling shortcode rendering

Monitoring Recommendations

Enable file integrity monitoring on wp-content/plugins/td-composer/ and wp-content/uploads/
Log and review all contributor and author account creations, especially on sites permitting open registration
Alert on web shell indicators such as eval(, base64_decode(, or system( appearing in newly written files

How to Mitigate CVE-2024-3813

Immediate Actions Required

Update the tagDiv Composer plugin to a version later than 4.8 as soon as the vendor releases a fix
Audit all contributor, author, and editor accounts and remove any that are unrecognized or inactive
Disable open user registration on the site until the plugin is patched
Scan the WordPress installation for web shells and unauthorized PHP files in upload directories

Patch Information

No fixed version is listed in the NVD record at the time of publication. Administrators should monitor the Wordfence Vulnerability Report and the vendor's release notes for a security update, then apply it across all environments.

Workarounds

Deactivate the tagDiv Composer plugin until a patched version is installed
Restrict contributor and author roles using a role management plugin to remove shortcode-editing capabilities where feasible
Configure the web server to deny PHP execution within wp-content/uploads/ and other user-writable directories
Deploy a WordPress-aware web application firewall (WAF) rule that blocks block_template_id values containing ../, absolute paths, or non-template file extensions

bash

# Example: deny PHP execution in the WordPress uploads directory (Apache)
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
    Require all denied
</FilesMatch>