CVE-2024-54362 Overview
CVE-2024-54362 is a path traversal vulnerability in the boggibill GetShop ecommerce WordPress plugin (getshop-ecommerce). The flaw affects all plugin versions up to and including 1.3. Attackers exploit the issue using .../...// sequences that bypass naive sanitization, classified under [CWE-35] Path Traversal. Successful exploitation allows remote, unauthenticated attackers to access files outside the intended directory on the WordPress server.
Critical Impact
A network-based attacker with no authentication can read, write, or otherwise impact files outside the plugin's intended scope, leading to confidentiality, integrity, and availability loss on affected WordPress installations.
Affected Products
- WordPress plugin getshop-ecommerce by boggibill
- Versions from n/a through <= 1.3
- WordPress sites with the GetShop ecommerce plugin installed and active
Discovery Timeline
- 2025-03-28 - CVE-2024-54362 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-54362
Vulnerability Analysis
The GetShop ecommerce plugin fails to properly canonicalize file paths supplied through user-controlled input. Attackers craft path segments such as .../...// to escape the intended directory. Many traversal filters strip a single ../ instance but do not handle overlapping or doubled separators. The remaining sequence is reinterpreted by the filesystem layer as a parent-directory reference.
Because the attack requires no authentication and travels over the network, exploitation can target any reachable WordPress installation running the affected plugin. The Exploit Prediction Scoring System (EPSS) data reports a probability of 0.443% with a percentile of 35.346, indicating limited but non-zero observed exploitation interest.
Root Cause
The root cause is improper sanitization of user-supplied path components, tracked as [CWE-35] Path Traversal: .../...//. The plugin's input handler removes simple ../ patterns but does not iteratively re-scan the result. Nested traversal tokens survive the filter and resolve to higher directories when passed to filesystem APIs.
Attack Vector
Attack vector is Network with no privileges required and no user interaction. An attacker sends a crafted HTTP request to a plugin endpoint that accepts a file path or filename parameter. The malicious value embeds .../...// sequences that resolve outside the WordPress plugin or upload directory once partial sanitization runs. No verified public proof-of-concept code is currently available; see the Patchstack WordPress Plugin Vulnerability advisory for additional technical context.
Detection Methods for CVE-2024-54362
Indicators of Compromise
- HTTP request parameters containing .../...//, ....//, or repeated dot-slash sequences targeting getshop-ecommerce endpoints under /wp-content/plugins/getshop-ecommerce/
- Web server access logs showing unauthenticated requests to plugin PHP files with file or path query parameters
- Unexpected reads of sensitive files such as wp-config.php, .htaccess, or files under /etc/
Detection Strategies
- Inspect WordPress access logs and WAF logs for traversal token patterns including ..%2F, ....//, and .../...//
- Alert on any HTTP 200 responses to getshop-ecommerce endpoints when the request includes path-like parameters
- Correlate plugin requests with subsequent filesystem reads of files outside wp-content/uploads/ using endpoint telemetry
Monitoring Recommendations
- Enable WordPress file integrity monitoring across wp-config.php, theme files, and plugin directories
- Forward webserver and PHP error logs to a central platform for retrospective hunting of traversal patterns
- Track outbound web shell or backdoor indicators if file write primitives are reachable through the same flaw
How to Mitigate CVE-2024-54362
Immediate Actions Required
- Deactivate and remove the getshop-ecommerce plugin until a vendor-released patched version above 1.3 is confirmed available
- Restrict access to the WordPress admin and plugin endpoints using IP allowlists or authentication at the reverse proxy
- Deploy a Web Application Firewall (WAF) rule blocking traversal patterns in requests to /wp-content/plugins/getshop-ecommerce/
Patch Information
No vendor patch is referenced in the NVD record at publication. Affected versions are listed as n/a through <= 1.3. Review the Patchstack WordPress Plugin Vulnerability advisory for the latest remediation status from the maintainer.
Workarounds
- Disable the plugin entirely if business operations permit
- Add WAF signatures matching .../...//, ....//, and URL-encoded variants such as %2E%2E%2F in query strings and POST bodies
- Apply least-privilege filesystem permissions on the PHP worker account to limit readable paths outside wp-content/
- Enforce open_basedir restrictions in PHP to constrain accessible directories
# Example php.ini hardening for the affected vhost
open_basedir = "/var/www/wordpress/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
