CVE-2024-39624: Cridio Listingpro Path Traversal Vulnerability

CVE-2024-39624 Overview

CVE-2024-39624 is a path traversal vulnerability in the CridioStudio ListingPro WordPress theme. The flaw allows authenticated attackers to perform PHP Local File Inclusion (LFI) by manipulating pathname parameters. Affected versions include all releases up to and including 2.9.4. The vulnerability is categorized under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Because ListingPro powers business directory and listing websites on WordPress, exploitation exposes site configuration files, credentials, and enables execution of attacker-controlled PHP through log poisoning or session file inclusion.

Critical Impact
Authenticated attackers can read arbitrary local files and achieve remote code execution through PHP Local File Inclusion, leading to full compromise of the WordPress site.

Affected Products

CridioStudio ListingPro WordPress theme versions up to and including 2.9.4
WordPress sites running ListingPro on any supported PHP runtime
Directory and listing websites built on the ListingPro theme framework

Discovery Timeline

2024-08-01 - CVE-2024-39624 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39624

Vulnerability Analysis

The vulnerability originates in a ListingPro request handler that accepts a user-supplied file path parameter and passes it to a PHP file inclusion function without normalization or allow-list validation. Because the parameter is concatenated into an include or require call, an attacker can traverse the directory structure using ../ sequences.

Exploitation requires low-privilege authentication, meaning any registered WordPress user account is sufficient. Once included, the target file is parsed by the PHP interpreter. This enables both sensitive file disclosure and code execution when the attacker can control the contents of an included file such as an uploaded image, a session file, or a log file entry.

Successful exploitation compromises confidentiality, integrity, and availability of the WordPress installation. The EPSS score of 0.525% (42nd percentile) reflects moderate exploitation likelihood for internet-facing installations.

Root Cause

The root cause is missing input validation on a file path parameter that is subsequently used in a PHP inclusion statement. The handler does not restrict the parameter to a pre-approved list of files, does not resolve the canonical path, and does not verify that the resolved path stays within the theme directory.

Attack Vector

An authenticated attacker sends an HTTP request to a vulnerable ListingPro endpoint with a crafted path parameter containing directory traversal sequences. The server-side handler resolves the path outside the intended directory and includes the file through PHP. Attackers commonly pair LFI with log poisoning, session file poisoning, or PHP wrapper abuse (for example php://filter) to escalate from file read to code execution.

The vulnerability manifests through unsanitized parameter handling in ListingPro request routing. Refer to the Patchstack ListingPro Theme Vulnerability advisory for additional technical context.

Detection Methods for CVE-2024-39624

Indicators of Compromise

HTTP requests to ListingPro endpoints containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f
Requests referencing PHP wrappers including php://filter, php://input, or data:// in query parameters
Access patterns targeting wp-config.php, /etc/passwd, /proc/self/environ, or PHP session files
Unexpected include or require warnings in PHP error logs referencing paths outside the theme directory

Detection Strategies

Inspect web server access logs for GET or POST parameters containing traversal patterns directed at ListingPro theme paths
Enable a Web Application Firewall (WAF) rule set targeting [CWE-22] path traversal signatures for WordPress themes
Correlate authenticated session activity with anomalous file access errors in PHP-FPM or Apache logs

Monitoring Recommendations

Alert on any HTTP 200 response to ListingPro requests whose parameters contain encoded or literal directory traversal tokens
Monitor file integrity on wp-config.php, theme directories, and the WordPress uploads path for unauthorized modification
Track newly created low-privilege accounts followed shortly by requests to ListingPro AJAX or template-loading endpoints

How to Mitigate CVE-2024-39624

Immediate Actions Required

Upgrade ListingPro to a version later than 2.9.4 that contains the vendor-supplied patch
Audit WordPress user accounts and revoke or reset credentials for accounts created during the exposure window
Rotate WordPress secrets in wp-config.php, database credentials, and any API keys stored on the host
Review web server logs for prior exploitation attempts dating back to the theme installation date

Patch Information

CridioStudio addressed the issue in a release following ListingPro 2.9.4. Refer to the Patchstack advisory for the fixed version and update instructions. Apply the update through the WordPress theme updater or by replacing the theme files with the patched release.

Workarounds

Restrict WordPress registration and require administrator approval for new accounts to reduce the pool of authenticated attackers
Deploy a WordPress-aware WAF with rules blocking ../ sequences and PHP wrapper schemes in request parameters
Set open_basedir and disable_functions in php.ini to constrain PHP file access to the WordPress root
Disable the ListingPro theme until the patched version can be applied if the site is not business-critical

bash

# Example php.ini hardening to limit LFI blast radius
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off
expose_php = Off