CVE-2024-54373 Overview
CVE-2024-54373 is a Path Traversal vulnerability [CWE-22] in the Chris Gardenberg EduAdmin Booking WordPress plugin (eduadmin-booking). The flaw affects all versions up to and including 5.2.0 and enables PHP Local File Inclusion (LFI). Authenticated attackers with low privileges can manipulate file path parameters to include arbitrary local files during PHP execution. Successful exploitation exposes sensitive configuration data, source code, and can lead to remote code execution when combined with file upload or log poisoning techniques.
Critical Impact
Attackers can read arbitrary files on the WordPress server, including wp-config.php, and potentially escalate to code execution through PHP file inclusion.
Affected Products
- Chris Gardenberg EduAdmin Booking plugin for WordPress
- All versions from initial release through 5.2.0
- WordPress sites with the eduadmin-booking plugin installed and active
Discovery Timeline
- 2024-12-16 - CVE-2024-54373 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-54373
Vulnerability Analysis
The EduAdmin Booking plugin fails to properly sanitize user-supplied input used in file path operations. This allows directory traversal sequences such as ../ to escape the intended base directory. The plugin then passes the crafted path to a PHP file inclusion function, resulting in Local File Inclusion.
Exploitation requires network access and low-privilege authentication on the target WordPress instance. The attack complexity is high, indicating specific conditions must be met for reliable exploitation. Impact spans confidentiality, integrity, and availability because included files execute within the PHP process context.
The vulnerability sits in the Path Traversal weakness class [CWE-22]. LFI in PHP applications frequently escalates to remote code execution through log poisoning, session file inclusion, or inclusion of uploaded media files containing PHP payloads.
Root Cause
The plugin accepts file path parameters from HTTP requests without applying canonicalization or allowlist validation. Traversal sequences are not stripped, and the resolved path is not verified to remain within the plugin's intended directory before being passed to include, require, or equivalent PHP functions.
Attack Vector
An authenticated attacker sends a crafted HTTP request to a vulnerable plugin endpoint containing directory traversal sequences in a file path parameter. The plugin resolves the path and includes the target file. Attackers typically target wp-config.php for database credentials or PHP files under attacker-controlled locations for code execution.
See the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-54373
Indicators of Compromise
- HTTP requests to eduadmin-booking plugin endpoints containing ../ or URL-encoded traversal sequences such as %2e%2e%2f
- Access log entries referencing sensitive files like wp-config.php, /etc/passwd, or PHP session files through plugin parameters
- Unexpected outbound connections or new PHP files created in the WordPress uploads directory following plugin requests
- Web server error logs showing failed include or require operations from the eduadmin-booking plugin path
Detection Strategies
- Deploy web application firewall rules that inspect query strings and POST bodies for directory traversal patterns targeting the plugin
- Monitor PHP include/require operations resolving to paths outside the plugin directory
- Correlate authenticated WordPress sessions with anomalous file access patterns against plugin endpoints
Monitoring Recommendations
- Enable WordPress audit logging for plugin activity and administrative actions
- Forward web server access logs to a centralized SIEM for pattern analysis
- Alert on any read access to wp-config.php outside expected application flows
How to Mitigate CVE-2024-54373
Immediate Actions Required
- Identify all WordPress installations running the eduadmin-booking plugin and confirm installed versions
- Deactivate the plugin on any site running version 5.2.0 or earlier until a patched release is applied
- Rotate WordPress database credentials, secret keys, and salts if exploitation is suspected
- Review web server access logs for traversal patterns targeting plugin endpoints over the past 90 days
Patch Information
At the time of this writing, refer to the Patchstack Vulnerability Report for the current fixed version. Upgrade to any release later than 5.2.0 published by the vendor.
Workarounds
- Restrict access to the WordPress admin area using IP allowlisting or VPN requirements to limit exposure of authenticated endpoints
- Deploy a web application firewall with rules blocking ../ and URL-encoded traversal sequences in requests to the plugin
- Enforce open_basedir restrictions in PHP configuration to constrain file inclusion to the WordPress installation directory
- Set file system permissions so the PHP process cannot read sensitive files outside the web root
# Example php.ini hardening to limit LFI impact
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
