CVE-2024-38746: MakeStories Path Traversal Vulnerability

CVE-2024-38746 Overview

CVE-2024-38746 is a path traversal vulnerability in the MakeStories (for Google Web Stories) WordPress plugin developed by the MakeStories Team. The flaw enables authenticated attackers to read arbitrary files from the server and issue Server-Side Request Forgery (SSRF) requests to internal resources. The vulnerability affects all versions up to and including 3.0.3. The issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated attackers with low privileges can download arbitrary files from the WordPress host and pivot to internal services via SSRF, exposing configuration files, credentials, and internal network resources.

Affected Products

MakeStories (for Google Web Stories) WordPress plugin, all versions through 3.0.3
WordPress installations with the MakeStories Helper component enabled
Sites relying on the vulnerable arbitrary file download and SSRF-affected endpoints

Discovery Timeline

2024-08-01 - CVE-2024-38746 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38746

Vulnerability Analysis

The MakeStories plugin exposes functionality that accepts user-supplied paths or URLs without validating them against a restricted base directory. An authenticated attacker submits a manipulated path parameter containing traversal sequences such as ../ to escape the plugin's intended working directory. The same input surface accepts remote URLs, which the server fetches on behalf of the requester, producing an SSRF condition.

Successful exploitation returns file contents to the attacker or reaches internal HTTP endpoints not exposed to the public internet. Sensitive targets include wp-config.php, private keys, and cloud metadata services such as http://169.254.169.254/. The combined path traversal and SSRF capabilities give attackers a reconnaissance and credential-harvesting primitive against WordPress hosts.

Root Cause

The root cause is missing input validation on file path and URL parameters processed by the plugin's helper endpoints. The plugin does not canonicalize supplied paths, does not enforce an allowlist of directories, and does not restrict outbound request destinations. Any authenticated user meeting the endpoint's privilege requirement can supply arbitrary values.

Attack Vector

Exploitation occurs over the network against the WordPress site. The attacker must hold valid credentials with low privileges, consistent with the CVSS vector requirement of PR:L. The attacker sends a crafted HTTP request to the vulnerable MakeStories endpoint containing either a traversal string in the file parameter or an internal URL in the fetch parameter. The server processes the request and returns the retrieved content in the HTTP response. See the Patchstack advisory for technical details.

Detection Methods for CVE-2024-38746

Indicators of Compromise

HTTP requests to MakeStories plugin endpoints containing ../ sequences or encoded variants such as %2e%2e%2f
Outbound requests from the WordPress host to internal IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) or cloud metadata endpoints such as 169.254.169.254
Access log entries showing authenticated users retrieving unusual file types including .php, .env, .key, or wp-config.php

Detection Strategies

Monitor WordPress access logs for requests to /wp-admin/admin-ajax.php or plugin-specific routes containing path traversal patterns
Inspect outbound network traffic from web servers for connections to link-local, loopback, or RFC1918 addresses
Correlate low-privileged user sessions with anomalous file access patterns using web application firewall telemetry

Monitoring Recommendations

Enable verbose HTTP request logging on the WordPress host and forward logs to a centralized SIEM for correlation
Alert on repeated 200 responses to requests containing traversal signatures against plugin endpoints
Track new or unusual user-agent strings authenticating as low-privilege WordPress accounts

How to Mitigate CVE-2024-38746

Immediate Actions Required

Update the MakeStories (for Google Web Stories) plugin to a version later than 3.0.3 as soon as a fixed release is available from the vendor
Audit WordPress user accounts and revoke credentials for suspicious or dormant low-privilege users
Rotate any secrets stored in wp-config.php and connected services if compromise is suspected

Patch Information

Monitor the Patchstack advisory and the WordPress plugin repository for a patched release above version 3.0.3. Apply the update through the WordPress admin console or via wp-cli.

Workarounds

Disable and remove the MakeStories plugin until a patched version is installed
Deploy web application firewall rules blocking path traversal patterns and requests targeting plugin endpoints
Restrict outbound network access from the WordPress host to prevent SSRF from reaching internal services and cloud metadata APIs

bash

# Disable the vulnerable plugin via wp-cli
wp plugin deactivate makestories-helper
wp plugin delete makestories-helper

# Example nginx rule to block traversal attempts
location ~* /wp-content/plugins/makestories-helper/ {
    if ($args ~* "\.\./|%2e%2e%2f") {
        return 403;
    }
}