CVE-2024-43345: Landing Page Builder Path Traversal Flaw

CVE-2024-43345 Overview

CVE-2024-43345 is a path traversal vulnerability in the PluginOps Landing Page Builder plugin for WordPress. The flaw affects all versions up to and including 1.5.2.0. Attackers can abuse improper pathname sanitization to trigger PHP Local File Inclusion (LFI) on the server. Successful exploitation lets an authenticated attacker read sensitive files or execute PHP code sourced from attacker-controlled locations. The issue is tracked under CWE-22 and was disclosed through the Patchstack Vulnerability Report.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, leading to information disclosure, code execution, and full compromise of the WordPress site.

Affected Products

PluginOps Landing Page Builder plugin for WordPress
All versions from unspecified initial release through 1.5.2.0
WordPress installations running the vulnerable plugin

Discovery Timeline

2024-08-19 - CVE-2024-43345 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43345

Vulnerability Analysis

The Landing Page Builder plugin fails to properly limit pathnames supplied to file-handling routines. An authenticated attacker submits a crafted path containing traversal sequences such as ../ to escape the intended directory. The plugin then resolves the path and includes the target file through a PHP include or require call. Because PHP evaluates included files as code, any .php file the web server can read becomes executable within the plugin's context. Attackers can also read configuration files such as wp-config.php to harvest database credentials and authentication keys.

Root Cause

The root cause is missing input sanitization on a parameter that feeds a file inclusion sink. The plugin does not validate user-supplied path components against an allowlist, does not call realpath() to canonicalize the target, and does not enforce a base directory constraint. This allows traversal sequences to reach the underlying filesystem API. Refer to the Patchstack advisory for the specific parameter and code path.

Attack Vector

Exploitation occurs over the network against the WordPress HTTP interface. The attacker requires low-privilege authenticated access to reach the vulnerable endpoint. Attack complexity is high, which suggests the exploit depends on specific site configuration or timing conditions. The current EPSS probability is 0.541% at the 42.6th percentile, and no public proof-of-concept is listed in the referenced sources.

No verified exploitation code is available. See the Patchstack Vulnerability Report for advisory-level technical details.

Detection Methods for CVE-2024-43345

Indicators of Compromise

HTTP requests to Landing Page Builder endpoints containing ../, ..\, or URL-encoded variants such as %2e%2e%2f in parameters that reference templates or files.
Unexpected reads of sensitive files such as wp-config.php, /etc/passwd, or session storage from the PHP-FPM or Apache worker process.
New or modified PHP files inside wp-content/uploads/ shortly after suspicious plugin requests.
Outbound connections from the web server initiated by PHP processes following inbound requests to plugin endpoints.

Detection Strategies

Inspect web server access logs for requests to wp-admin/admin-ajax.php or plugin routes carrying path traversal payloads.
Deploy WordPress-aware web application firewall rules that block traversal sequences in plugin parameters.
Enable PHP open_basedir and monitor logs for open_basedir restriction in effect warnings tied to plugin activity.
Correlate authenticated user sessions with abnormal file read patterns using file integrity monitoring.

Monitoring Recommendations

Alert on any HTTP request to Landing Page Builder handlers containing traversal metacharacters.
Track process ancestry where php-fpm or httpd spawns shells, curl, or wget unexpectedly.
Monitor authentication logs for low-privilege accounts that suddenly access administrative plugin endpoints.

How to Mitigate CVE-2024-43345

Immediate Actions Required

Update the PluginOps Landing Page Builder plugin to a version later than 1.5.2.0 once the vendor publishes a fix.
Disable and remove the plugin if no patched release is available for your environment.
Rotate WordPress secrets in wp-config.php and database credentials if exploitation is suspected.
Audit user accounts with plugin access and remove unnecessary contributor or higher privileges.

Patch Information

At the time of publication, the vendor advisory referenced by Patchstack confirms the vulnerability exists through version 1.5.2.0. Administrators should consult the Patchstack entry and the plugin's WordPress.org page for the latest fixed release before upgrading.

Workarounds

Restrict access to WordPress administrative endpoints using IP allowlists at the web server or WAF layer.
Configure PHP open_basedir to confine file inclusion to the WordPress document root.
Set disable_functions to block dangerous PHP functions where the application does not require them.
Deploy virtual patching rules that reject traversal sequences in requests targeting the plugin.

bash

# Configuration example: restrict PHP file access via open_basedir
# /etc/php/8.2/fpm/pool.d/wordpress.conf
php_admin_value[open_basedir] = "/var/www/wordpress/:/tmp/"
php_admin_value[disable_functions] = "exec,passthru,shell_exec,system,proc_open,popen"

# Nginx rule to block traversal patterns targeting the plugin
location ~* /wp-content/plugins/page-builder-add/ {
    if ($args ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
}