CVE-2024-38768: Pack Elementor Addons Path Traversal

CVE-2024-38768 Overview

CVE-2024-38768 is a path traversal vulnerability [CWE-22] in the Webangon The Pack Elementor Addons plugin for WordPress. The flaw allows authenticated attackers to perform PHP Local File Inclusion (LFI) by supplying manipulated pathname input. All versions up to and including 2.0.8.6 are affected.

Successful exploitation enables an attacker to read sensitive server files, include arbitrary PHP files, and potentially execute code within the WordPress environment. The vulnerability requires only low-privilege authentication and no user interaction over the network.

Critical Impact
Attackers with low-privilege WordPress accounts can traverse the file system, include local PHP files, and achieve full compromise of confidentiality, integrity, and availability on affected sites.

Affected Products

Webangon The Pack Elementor Addons (WordPress plugin)
All versions from n/a through 2.0.8.6
WordPress sites running the plugin (the-pack-addon)

Discovery Timeline

2024-08-01 - CVE-2024-38768 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38768

Vulnerability Analysis

The vulnerability stems from improper limitation of a pathname to a restricted directory within The Pack Elementor Addons plugin. The plugin accepts user-controlled input that is passed to PHP file-inclusion functions without adequate validation or normalization. Attackers can inject traversal sequences such as ../ to escape the intended directory boundary.

Because the plugin uses the tainted path in a PHP include or require operation, the flaw becomes a Local File Inclusion (LFI) rather than a read-only path traversal. Any PHP file readable by the web server can be executed within the request context. An authenticated attacker with contributor-level or similar low privileges can trigger the vulnerable endpoint on the WordPress site.

Root Cause

The root cause is missing sanitization of file path parameters before they reach PHP inclusion sinks. The plugin does not enforce an allowlist of permitted templates or resolve the canonical path before use. Directory traversal characters are neither stripped nor rejected, allowing arbitrary paths under the web server user context.

Attack Vector

An authenticated attacker sends a crafted HTTP request to a plugin endpoint that accepts a file or template parameter. The attacker embeds traversal sequences pointing to a target file, for example WordPress configuration or a log file previously poisoned with PHP payloads. The server includes the file and, if it contains PHP code, executes it. Refer to the Patchstack Vulnerability Report for the technical writeup.

Detection Methods for CVE-2024-38768

Indicators of Compromise

HTTP requests to The Pack Elementor Addons endpoints containing ../, ..\, URL-encoded traversal (%2e%2e%2f), or absolute paths such as /etc/passwd.
Unexpected PHP process activity reading files outside the plugin directory (wp-content/plugins/the-pack-addon/).
Web server access logs showing parameter values referencing wp-config.php, /proc/self/environ, or session files.
New or modified PHP files in WordPress upload directories following suspicious plugin requests.

Detection Strategies

Deploy web application firewall (WAF) rules that flag path traversal patterns targeting /wp-content/plugins/the-pack-addon/ URIs.
Correlate authenticated low-privilege user sessions with abnormal file-inclusion parameter usage.
Baseline legitimate plugin request parameters and alert on deviations that reference file system paths.

Monitoring Recommendations

Ingest WordPress access and PHP error logs into a centralized SIEM for continuous inspection.
Alert on PHP include/require warnings referencing paths outside the plugin directory.
Monitor file integrity for wp-config.php, plugin directories, and upload folders.

How to Mitigate CVE-2024-38768

Immediate Actions Required

Identify all WordPress instances running The Pack Elementor Addons at version 2.0.8.6 or earlier and prioritize patching.
Restrict contributor and higher-role account creation until the plugin is updated.
Rotate WordPress secret keys and administrative credentials if exploitation indicators are found.
Review the Patchstack advisory for vendor guidance and fixed version details.

Patch Information

Update The Pack Elementor Addons to a version later than 2.0.8.6 as published by Webangon. Consult the Patchstack Vulnerability Report for the current fixed release. If no fixed version is available in your channel, deactivate and remove the plugin.

Workarounds

Disable The Pack Elementor Addons until a patched release is deployed.
Deploy WAF signatures blocking path traversal sequences on plugin endpoints.
Harden PHP with open_basedir restrictions to limit file inclusion scope.
Enforce least-privilege on WordPress roles to reduce the pool of accounts able to reach authenticated endpoints.

bash

# Example PHP hardening in php.ini or per-vhost configuration
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"