CVE-2024-43135: WPCafe Path Traversal Vulnerability

CVE-2024-43135 Overview

CVE-2024-43135 is a path traversal vulnerability in the Themewinter WPCafe plugin for WordPress. The flaw allows authenticated attackers to perform PHP Local File Inclusion (LFI) by supplying crafted input that escapes the intended directory. All versions of WPCafe up to and including 2.2.28 are affected. The vulnerability is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory) and enables attackers to read sensitive files or execute arbitrary PHP code hosted on the server. Successful exploitation can lead to full compromise of the WordPress installation, including theft of database credentials stored in wp-config.php.

Critical Impact
Authenticated attackers can include arbitrary PHP files on the WordPress server, leading to sensitive information disclosure and potential remote code execution.

Affected Products

Themewinter WPCafe plugin for WordPress
WPCafe versions from n/a through 2.2.28
WordPress sites running the vulnerable plugin

Discovery Timeline

2024-08-13 - CVE-2024-43135 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43135

Vulnerability Analysis

The WPCafe plugin fails to properly sanitize user-supplied input used to construct file paths. Attackers can traverse the directory structure using sequences such as ../ to reference files outside the intended directory. Because the resulting path is passed to a PHP file inclusion function, the included file is interpreted and executed as PHP code. This transforms a directory traversal issue into a Local File Inclusion vulnerability with code execution potential.

Exploitation requires only low-privilege authentication, meaning any user account on the WordPress site can attempt the attack. Attackers commonly abuse LFI to read configuration files, session data, or log files. If an attacker can plant PHP content into a readable file such as an uploaded image or log entry, they can achieve remote code execution.

Root Cause

The root cause is missing validation and normalization of file path input before it reaches a PHP include or require statement. The plugin does not restrict inclusion targets to an allow-list of expected files. It also does not strip directory traversal sequences from user-supplied parameters.

Attack Vector

The attack is delivered over the network through HTTP requests to plugin endpoints. An authenticated user submits a request containing a manipulated file path parameter. The plugin resolves the path and includes the target file, executing any PHP contained within it. See the Patchstack Vulnerability Advisory for the technical writeup.

Detection Methods for CVE-2024-43135

Indicators of Compromise

HTTP requests to WPCafe plugin endpoints containing directory traversal sequences such as ../, ..%2f, or URL-encoded variants
Access log entries referencing sensitive files including wp-config.php, /etc/passwd, or PHP session files
Unexpected PHP file inclusions originating from the wp-content/plugins/wp-cafe/ directory
New administrative users or modifications to WordPress core files following suspicious plugin requests

Detection Strategies

Inspect web server access logs for requests to WPCafe endpoints containing traversal patterns or encoded path separators
Monitor PHP error logs for warnings about failed include or require operations referencing unexpected file paths
Deploy web application firewall rules that block path traversal sequences in query and POST parameters targeting the plugin

Monitoring Recommendations

Alert on file system access to wp-config.php from the web server process outside of expected WordPress startup
Track outbound network connections from the PHP-FPM or Apache worker process for signs of post-exploitation activity
Baseline plugin request patterns and flag deviations, particularly parameters containing .., null bytes, or encoded slashes

How to Mitigate CVE-2024-43135

Immediate Actions Required

Update the WPCafe plugin to a version later than 2.2.28 as soon as the vendor releases a patched build
Audit WordPress user accounts and remove or reset credentials for any low-privilege accounts that are not required
Review web server access logs for signs of exploitation attempts against WPCafe endpoints prior to patching

Patch Information

The vulnerability affects WPCafe through version 2.2.28. Site administrators should consult the Patchstack Vulnerability Advisory for fixed version guidance and apply the vendor update through the WordPress plugin dashboard.

Workarounds

Deactivate the WPCafe plugin until a patched version is installed if the plugin is not business-critical
Deploy a web application firewall rule that blocks path traversal patterns targeting /wp-content/plugins/wp-cafe/ request paths
Restrict PHP open_basedir settings to confine file inclusion to the WordPress installation directory
Enforce least-privilege on WordPress user roles to reduce the pool of accounts capable of triggering the flaw

bash

# Example open_basedir restriction in php.ini or .htaccess
php_admin_value open_basedir "/var/www/html/wordpress/:/tmp/"

# Example ModSecurity rule to block traversal attempts against WPCafe
SecRule REQUEST_URI "@contains /wp-content/plugins/wp-cafe/" \
  "chain,deny,status:403,id:1004311,msg:'WPCafe path traversal attempt'"
  SecRule ARGS "@rx (\.\./|\.\.%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"