CVE-2024-39621: Cridio Listingpro Path Traversal Flaw

CVE-2024-39621 Overview

CVE-2024-39621 is a path traversal vulnerability [CWE-22] in the CridioStudio ListingPro WordPress plugin that enables PHP Local File Inclusion (LFI). The flaw affects all versions of listingpro-plugin up to and including 2.9.4. An authenticated attacker with high privileges can traverse directories and include arbitrary PHP files on the server. Successful exploitation leads to disclosure of sensitive data, code execution through included files, and full compromise of the WordPress site.

Critical Impact
An authenticated attacker can include arbitrary PHP files on the server, resulting in high impact to confidentiality, integrity, and availability of the affected WordPress site.

Affected Products

CridioStudio ListingPro WordPress plugin versions through 2.9.4
WordPress sites running listingpro-plugin 2.9.3 and prior
Directory listing websites built on the ListingPro theme ecosystem

Discovery Timeline

2024-08-01 - CVE-2024-39621 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39621

Vulnerability Analysis

The vulnerability stems from improper limitation of a pathname to a restricted directory within the ListingPro plugin. User-supplied input is passed to a PHP file inclusion function without proper sanitization or canonicalization. The plugin fails to validate that requested file paths remain within an approved directory. Attackers can supply traversal sequences such as ../ to escape the intended directory and reference arbitrary files.

Once a malicious path is accepted, the PHP interpreter executes any included file as code. This transforms a file-read primitive into an arbitrary code execution primitive when combined with attacker-controlled content on disk. Log files, uploaded media, session data, and temporary files all become potential execution vectors. The attack requires network access and authenticated high-privilege access, but no user interaction.

Root Cause

The root cause is missing input validation on file path parameters consumed by PHP inclusion functions such as include, require, or their variants. The plugin trusts request parameters and concatenates them into filesystem paths without allowlisting, normalization, or realpath() verification.

Attack Vector

An authenticated attacker sends a crafted HTTP request to a ListingPro plugin endpoint that accepts a file or template parameter. By injecting traversal sequences, the attacker forces the plugin to load a file outside the plugin directory. The included file is then parsed as PHP, allowing the attacker to read sensitive configuration such as wp-config.php or execute code from attacker-controlled files already present on the server.

Refer to the Patchstack ListingPro Plugin Vulnerability advisory for additional technical context.

Detection Methods for CVE-2024-39621

Indicators of Compromise

HTTP requests to ListingPro plugin endpoints containing traversal sequences such as ../, ..%2f, or URL-encoded null bytes
Web server access logs showing successful requests referencing files outside the wp-content/plugins/listingpro-plugin/ directory
Unexpected PHP process activity spawned from the WordPress user account after plugin requests
New or modified PHP files in upload directories immediately preceding LFI request patterns

Detection Strategies

Inspect web application firewall (WAF) telemetry for directory traversal payloads targeting listingpro-plugin URIs
Correlate authenticated administrative session activity with anomalous file access patterns on the WordPress host
Review PHP error logs for include/require warnings referencing paths outside the plugin directory

Monitoring Recommendations

Enable verbose HTTP request logging on WordPress sites running ListingPro and forward logs to a central analytics platform
Alert on any inclusion of sensitive files such as wp-config.php, /etc/passwd, or PHP session files
Monitor for outbound network connections initiated by the PHP-FPM process following suspicious plugin requests

How to Mitigate CVE-2024-39621

Immediate Actions Required

Upgrade the ListingPro plugin to a version later than 2.9.4 as soon as the vendor publishes a patched release
Rotate all WordPress administrator credentials and API keys stored in wp-config.php if exploitation is suspected
Audit the wp-content/uploads/ directory for unexpected PHP files and remove any unauthorized artifacts

Patch Information

CridioStudio addresses the vulnerability in releases after ListingPro 2.9.4. Consult the Patchstack advisory for the current fixed version. Apply the vendor patch through the WordPress plugin update mechanism and verify the installed version after upgrade.

Workarounds

Restrict administrative access to the WordPress site using IP allowlisting until the patch is applied
Deploy a WAF rule that blocks traversal sequences in query parameters targeting listingpro-plugin endpoints
Enable PHP open_basedir restrictions to constrain file inclusion to the WordPress installation directory
Temporarily deactivate the ListingPro plugin if administrative workflows can tolerate the outage

bash

# Configuration example: restrict PHP file inclusion scope via php.ini
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system"
allow_url_include = Off