CVE-2024-43129 Overview
CVE-2024-43129 is a path traversal vulnerability in the WPDeveloper BetterDocs plugin for WordPress. The flaw affects all versions up to and including 3.5.8. Attackers with low-privileged authenticated access can exploit improper pathname validation to trigger PHP Local File Inclusion (LFI). Successful exploitation allows adversaries to read arbitrary files on the server and, under common WordPress configurations, execute PHP code loaded through the inclusion path. The vulnerability maps to [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).
Critical Impact
Authenticated attackers can include and execute arbitrary PHP files on servers running BetterDocs 3.5.8 or earlier, leading to full site compromise.
Affected Products
- WPDeveloper BetterDocs WordPress plugin, all versions through 3.5.8
- WordPress sites using the BetterDocs knowledge base plugin
- Hosting environments where the vulnerable plugin is active and reachable over the network
Discovery Timeline
- 2024-08-13 - CVE-2024-43129 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43129
Vulnerability Analysis
The BetterDocs plugin exposes functionality that constructs file paths from user-controlled input without adequate normalization or allow-list validation. An authenticated attacker submits crafted path segments containing traversal sequences such as ../ to escape the intended template or documentation directory. The resolved path is then passed to a PHP file inclusion function, causing the interpreter to load and execute the referenced script. Because WordPress plugins run in the web server process, any included PHP file executes with the privileges of the WordPress runtime.
The issue affects confidentiality, integrity, and availability. Attackers can read sensitive files such as wp-config.php, include uploaded content to achieve remote code execution, or overwrite plugin behavior by loading attacker-controlled templates.
Root Cause
The root cause is missing sanitization of a filename or template parameter that is concatenated into a PHP include, require, or equivalent inclusion call. The plugin does not enforce a canonical base directory, does not resolve the final path with realpath(), and does not restrict inclusion to an allow list of known template files.
Attack Vector
Exploitation requires network access to the WordPress site and a valid low-privileged account, such as Subscriber or Contributor depending on the specific endpoint. The attacker sends an HTTP request to a BetterDocs endpoint with a manipulated path parameter. No user interaction is required beyond the attacker's own request. See the Patchstack Vulnerability Report for additional advisory context.
Detection Methods for CVE-2024-43129
Indicators of Compromise
- HTTP requests to BetterDocs plugin endpoints containing ../, ..%2f, or encoded traversal sequences in query or POST parameters
- Access log entries referencing wp-config.php, /etc/passwd, or /proc/self/environ through plugin request paths
- Unexpected PHP execution originating from the wp-content/uploads/ directory following BetterDocs requests
- New administrative users or modified plugin files created shortly after suspicious BetterDocs traffic
Detection Strategies
- Deploy web application firewall rules that inspect BetterDocs request parameters for path traversal patterns and reject them at the edge
- Correlate authenticated WordPress sessions with anomalous file inclusion behavior in PHP error logs
- Monitor file integrity on wp-content/plugins/betterdocs/ and the WordPress core for unauthorized modifications
Monitoring Recommendations
- Enable PHP log_errors and forward warnings related to include() and require() failures to a centralized log platform
- Alert on outbound network connections initiated by the PHP-FPM or web server process to unexpected destinations
- Track creation of new PHP files inside upload directories, which is a common post-exploitation artifact
How to Mitigate CVE-2024-43129
Immediate Actions Required
- Update the BetterDocs plugin to a version later than 3.5.8 as soon as the vendor publishes a fixed release
- Audit WordPress user accounts and remove or reset credentials for accounts that are not required
- Review web server and PHP error logs for evidence of traversal attempts against BetterDocs endpoints
Patch Information
Refer to the Patchstack Vulnerability Report for the most current patch guidance. Sites running version 3.5.8 or earlier must upgrade to the vendor-supplied fixed release.
Workarounds
- Deactivate and remove the BetterDocs plugin until a patched version is installed
- Restrict access to BetterDocs endpoints through a web application firewall or reverse proxy rule set
- Enforce PHP open_basedir restrictions to limit which directories the WordPress process can read and include
- Disable low-privilege account self-registration if it is not required by the site
# Example open_basedir restriction in php.ini or a vhost override
php_admin_value[open_basedir] = "/var/www/html/:/tmp/"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
