CVE-2024-54375: Woolook Path Traversal Vulnerability

CVE-2024-54375 Overview

CVE-2024-54375 is a path traversal vulnerability in the Sabri Woolook WordPress plugin that enables PHP Local File Inclusion (LFI). The flaw affects all versions of Woolook up to and including 1.7.0. An unauthenticated attacker can manipulate file path parameters to include arbitrary local files on the server. Successful exploitation can lead to disclosure of sensitive configuration data, source code, and in some configurations, remote code execution through log poisoning or session file inclusion. The issue is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated attackers can read arbitrary files on the WordPress host and may escalate to PHP code execution depending on server configuration.

Affected Products

Sabri Woolook WordPress plugin versions n/a through 1.7.0
WordPress sites with the Woolook plugin installed and activated
PHP environments hosting the vulnerable plugin

Discovery Timeline

2024-12-16 - CVE-2024-54375 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54375

Vulnerability Analysis

The Woolook plugin fails to properly sanitize user-supplied input used in file path operations. Attackers can supply traversal sequences such as ../ to break out of the intended directory and reference files elsewhere on the filesystem. Because the resolved path is passed to a PHP file inclusion function, the targeted file is parsed and executed as PHP code when applicable. The EPSS score is 0.675% with a percentile of 47.38, indicating measurable interest from threat actors scanning for vulnerable WordPress deployments.

Root Cause

The root cause is missing canonicalization and allow-list validation on a pathname parameter before it reaches a PHP inclusion sink such as include, require, include_once, or require_once. The plugin treats untrusted input as a trusted file reference, violating secure coding practices documented under CWE-22.

Attack Vector

Exploitation occurs over the network and requires user interaction, typically by enticing an authenticated user or administrator to visit a crafted URL or trigger a vulnerable request. The attacker injects a relative or absolute path into the vulnerable parameter, causing the application to include attacker-chosen files. Targets commonly include /etc/passwd, WordPress configuration files such as wp-config.php, server log files for log poisoning, and uploaded media used to smuggle PHP payloads. Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2024-54375

Indicators of Compromise

HTTP requests to Woolook plugin endpoints containing ../, ..%2f, or URL-encoded traversal sequences in query or POST parameters
Web server access logs showing inclusion attempts referencing wp-config.php, /etc/passwd, or /proc/self/environ
Unexpected PHP errors referencing failed include or require calls originating from plugin files
New or modified PHP files in plugin or upload directories following suspicious requests

Detection Strategies

Inspect WordPress access logs for requests targeting /wp-content/plugins/woolook/ with path parameters containing traversal patterns
Deploy web application firewall (WAF) rules that flag directory traversal sequences against plugin endpoints
Correlate file read events on wp-config.php with originating HTTP requests to detect exfiltration attempts
Monitor PHP error logs for inclusion failures that reveal probing activity

Monitoring Recommendations

Enable verbose access logging on the WordPress front-end and forward logs to a centralized analytics platform
Establish baseline behavior for plugin endpoints and alert on anomalous query parameter patterns
Track outbound connections from the web server that may indicate post-exploitation activity following file disclosure

How to Mitigate CVE-2024-54375

Immediate Actions Required

Identify all WordPress sites running the Woolook plugin and confirm installed versions
Disable or uninstall the Woolook plugin until a patched release is available
Rotate any credentials, API keys, and database secrets stored in wp-config.php that may have been exposed
Audit the filesystem for unauthorized PHP files dropped into plugin or upload directories

Patch Information

At the time of publication, no fixed version beyond 1.7.0 has been confirmed in the available references. Monitor the Patchstack Vulnerability Report and the official plugin repository for updates. Apply any vendor-released patch immediately upon publication.

Workarounds

Remove or deactivate the Woolook plugin entirely until a verified fix is released
Deploy WAF signatures that block directory traversal patterns such as ../, ..%2f, and ..%5c on plugin URLs
Apply restrictive filesystem permissions so the PHP process cannot read sensitive files outside the web root
Disable PHP allow_url_include and constrain open_basedir to the WordPress installation path to limit inclusion scope

bash

# Configuration example - php.ini hardening
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"