CVE-2024-43955 Overview
CVE-2024-43955 is a path traversal vulnerability in the Themeum Droip WordPress plugin. The flaw affects all versions of Droip from initial release through 1.1.1. An unauthenticated attacker can manipulate file paths over the network to download or delete arbitrary files on the WordPress host.
The vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Exploitation requires no authentication, no user interaction, and low attack complexity. The EPSS score is 1.131% (78.7th percentile), reflecting elevated probability of exploitation activity compared to most CVEs.
Critical Impact
Unauthenticated remote attackers can delete arbitrary files on the WordPress server, including wp-config.php, which can render the site unusable or force it into setup mode for full takeover.
Affected Products
- Themeum Droip plugin for WordPress, versions up to and including 1.1.1
- WordPress sites with the Droip plugin installed and activated
- Any hosting environment exposing the vulnerable plugin endpoints to the internet
Discovery Timeline
- 2024-08-29 - CVE-2024-43955 published to NVD
- 2026-04-28 - Last updated in NVD database
Technical Details for CVE-2024-43955
Vulnerability Analysis
The Droip plugin exposes functionality that accepts a file path parameter from unauthenticated HTTP requests. The plugin fails to validate or canonicalize the supplied path before passing it to file system operations. Attackers can submit traversal sequences such as ../ to escape the intended directory and reach arbitrary files on the server.
According to the Patchstack Vulnerability Report, the issue enables both arbitrary file download and arbitrary file deletion. File deletion is the higher-impact primitive on WordPress, because removing wp-config.php triggers the installation routine and allows an attacker to connect the site to a database under their control.
Root Cause
The root cause is missing input validation on user-supplied file path parameters in Droip plugin handlers. The code does not enforce a base directory, reject .. sequences, or apply an allow-list of permitted filenames. Combined with the absence of authentication and capability checks on the affected endpoints, any remote client can invoke the file operations.
Attack Vector
Exploitation occurs over the network against the WordPress site’s HTTP interface. An attacker sends a crafted request to the vulnerable Droip endpoint with a path parameter containing directory traversal sequences pointing to a target file. The plugin reads or unlinks the resolved path and returns a response. No credentials or user interaction are required. See the Patchstack advisory for additional technical context.
Detection Methods for CVE-2024-43955
Indicators of Compromise
- HTTP requests to Droip plugin endpoints under /wp-content/plugins/droip/ containing ../ or URL-encoded %2e%2e%2f sequences in query or body parameters
- Unexpected absence of wp-config.php, .htaccess, or theme and plugin files on disk
- WordPress site unexpectedly displaying the installation wizard at /wp-admin/install.php
- Outbound responses from the site containing contents of files outside the WordPress webroot
Detection Strategies
- Inspect web server access logs for unauthenticated POST or GET requests to Droip handlers carrying file path parameters
- Alert on traversal patterns such as ..%2f, ..\\, or absolute paths like /etc/passwd in plugin request parameters
- Monitor file integrity for WordPress core files and verify checksums against known-good baselines
- Correlate plugin endpoint access with subsequent file deletion events from the PHP worker process
Monitoring Recommendations
- Enable WordPress audit logging to capture plugin activity and file system changes
- Forward web server, PHP-FPM, and operating system file audit logs to a central SIEM for correlation
- Track requests to known Droip AJAX or REST routes and baseline expected traffic patterns
- Alert on creation of new administrator accounts or modification of wp-config.php following plugin endpoint access
How to Mitigate CVE-2024-43955
Immediate Actions Required
- Update the Droip plugin to a version later than 1.1.1 once the vendor releases a patched build
- If no patched version is available, deactivate and remove the Droip plugin from all WordPress sites
- Verify integrity of wp-config.php, core files, and uploads; restore from clean backups if tampering is suspected
- Rotate WordPress administrator credentials, database passwords, and any secrets stored in wp-config.php
Patch Information
At the time of NVD publication, the vulnerability affects Droip through 1.1.1 with no fixed version listed in the advisory. Refer to the Patchstack Vulnerability Report and the Themeum vendor channels for the latest fixed release.
Workarounds
- Block requests to Droip plugin endpoints at the web application firewall (WAF) until a patched version is deployed
- Add WAF rules that reject requests containing ../, ..\\, or encoded traversal sequences in any parameter
- Restrict file system permissions so the PHP process cannot delete WordPress core files or write outside the uploads directory
- Place the WordPress installation behind authentication or IP allow-lists for non-public sites
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
