CVE-2024-5147: WPZOOM Elementor Addons RCE Vulnerability

CVE-2024-5147 Overview

The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress contains a critical Local File Inclusion (LFI) vulnerability affecting all versions up to and including 1.1.37. The vulnerability exists in the grid_style parameter, which allows unauthenticated attackers to include and execute arbitrary files on the server. This flaw enables the execution of any PHP code present in those files, potentially leading to complete server compromise.

Critical Impact

Unauthenticated attackers can achieve remote code execution by exploiting this LFI vulnerability to include malicious PHP files, bypassing access controls and potentially gaining full control of the WordPress installation.

Affected Products

• WPZOOM Addons for Elementor (Templates, Widgets) versions up to and including 1.1.37
• WordPress installations using the vulnerable WPZOOM Elementor Addons plugin
• Any WordPress site with Elementor and the WPZOOM Addons plugin active

Discovery Timeline

• 2024-05-22 - CVE-2024-5147 published to NVD
• 2025-02-05 - Last updated in NVD database

Technical Details for CVE-2024-5147

Vulnerability Analysis

This Local File Inclusion vulnerability stems from insufficient input validation in the WPZOOM Addons for Elementor plugin. The vulnerable code resides in the wpzoom-elementor-ajax-posts-grid.php file, where the grid_style parameter is processed without adequate sanitization. When an attacker supplies a crafted path through this parameter, the application includes the specified file, leading to arbitrary file inclusion and potential code execution.

The attack requires no authentication, meaning any remote attacker with network access to the WordPress site can exploit this vulnerability. The exploitation can be used to bypass access controls, exfiltrate sensitive data such as database credentials from wp-config.php, or achieve full remote code execution when combined with file upload capabilities.

Root Cause

The root cause of this vulnerability is improper input validation and insufficient path sanitization of the grid_style parameter in the AJAX posts grid functionality. The plugin fails to properly validate and sanitize user-supplied input before using it in a file include operation, allowing attackers to traverse directories and include arbitrary files. The vulnerable code paths can be found in lines 105 and 112 of the wpzoom-elementor-ajax-posts-grid.php file.

Attack Vector

The attack is conducted over the network without requiring authentication. An attacker can craft a malicious HTTP request containing path traversal sequences in the grid_style parameter. By manipulating this parameter, the attacker can include local files from the server's filesystem.

In scenarios where file upload functionality exists (such as WordPress's media upload for images), an attacker could upload a file containing PHP code disguised as an image, then use this LFI vulnerability to include and execute that malicious code. This technique effectively transforms the LFI into Remote Code Execution (RCE).

The exploitation flow typically involves:

1. Identifying a target WordPress site running the vulnerable plugin version
2. Crafting a request with directory traversal sequences in the grid_style parameter
3. Including sensitive files or previously uploaded malicious files
4. Achieving code execution or data exfiltration

For technical details on the vulnerable code paths, see the WordPress Plugin Code Review.

Detection Methods for CVE-2024-5147

Indicators of Compromise

• Unusual HTTP requests to WordPress AJAX endpoints containing path traversal patterns (e.g., ../, ..%2f) in the grid_style parameter
• Web server logs showing access to the WPZOOM Elementor AJAX handler with suspicious parameter values
• Unexpected PHP file executions or error logs indicating file inclusion attempts
• Evidence of sensitive file access (e.g., wp-config.php, /etc/passwd) in application logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in request parameters
• Monitor WordPress AJAX requests for anomalous grid_style parameter values containing directory traversal sequences
• Deploy file integrity monitoring on critical WordPress files and the uploads directory
• Enable verbose logging for the WPZOOM Elementor Addons plugin and review for inclusion errors

Monitoring Recommendations

• Set up alerting for HTTP requests containing common LFI payloads targeting WordPress installations
• Monitor for unusual file access patterns, particularly attempts to read configuration files
• Implement network-level monitoring for outbound connections following potential successful exploitation
• Review WordPress user activity logs for any unauthorized administrative actions

How to Mitigate CVE-2024-5147

Immediate Actions Required

• Update the WPZOOM Addons for Elementor plugin to version 1.1.38 or later immediately
• If immediate update is not possible, temporarily deactivate the WPZOOM Addons for Elementor plugin
• Review server logs for any evidence of exploitation attempts
• Conduct a security audit of WordPress installations for signs of compromise

Patch Information

WPZOOM has released a security patch addressing this vulnerability. The fix is included in version 1.1.38 and later of the WPZOOM Addons for Elementor plugin. The patch implements proper input validation and sanitization for the grid_style parameter, preventing arbitrary file inclusion.

The patch details can be reviewed at the WordPress Changeset Overview. Additional vulnerability information is available in the Wordfence Vulnerability Report.

Workarounds

• Implement a Web Application Firewall (WAF) with rules to block path traversal patterns in HTTP requests
• Restrict access to WordPress admin and AJAX endpoints using IP allowlisting where feasible
• Disable file uploads temporarily if not essential for operations to reduce attack surface
• Add server-level protections using ModSecurity or similar tools to filter malicious requests

# Example Apache ModSecurity rule to block LFI attempts
SecRule ARGS "@contains ../" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'Potential Local File Inclusion Attack Blocked',\
    log,\
    auditlog"