CVE-2024-54376: EazyDocs PHP File Inclusion Vulnerability

CVE-2024-54376 Overview

CVE-2024-54376 is a PHP Local File Inclusion (LFI) vulnerability in the Spider Themes EazyDocs plugin for WordPress. The flaw stems from improper control of filenames used in PHP include or require statements [CWE-98]. Authenticated attackers with low privileges can manipulate file path parameters to include arbitrary local PHP files. The issue affects EazyDocs versions up to and including 2.8.0. Successful exploitation can lead to sensitive information disclosure, execution of attacker-controlled PHP files already present on the server, and full compromise of the WordPress application.

Critical Impact
Authenticated attackers can include local PHP files through the EazyDocs plugin, resulting in high confidentiality, integrity, and availability impact on affected WordPress sites.

Affected Products

Spider Themes EazyDocs WordPress plugin (all versions through 2.8.0)
WordPress installations with EazyDocs plugin activated
Sites using vulnerable EazyDocs versions in shared hosting environments

Discovery Timeline

2024-12-16 - CVE-2024-54376 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54376

Vulnerability Analysis

The vulnerability resides in EazyDocs plugin code that dynamically constructs file paths passed to PHP file inclusion functions. User-supplied input reaches an include, require, include_once, or require_once call without sufficient validation or normalization. An attacker with at least low-level authenticated access to the WordPress site can craft a request that forces the plugin to load an unintended PHP file from the local filesystem.

Because PHP executes any file loaded through inclusion, an included file containing PHP code runs in the context of the web server user. This differs from traditional path traversal, which only reads file contents. The attacker gains code execution when they can point the inclusion to files under their influence, such as uploaded media, log files with attacker-controlled content, or session files. See the Patchstack Vulnerability Report for details.

Root Cause

The root cause is improper control of the filename argument passed to a PHP include or require statement [CWE-98]. The plugin fails to enforce an allowlist of permitted files and does not sanitize traversal sequences or absolute paths before invoking the inclusion function.

Attack Vector

Exploitation requires network access to the WordPress site and authenticated user privileges. The attacker submits a request to a vulnerable EazyDocs endpoint with a manipulated file parameter. The plugin resolves the tainted path and executes the referenced PHP file. Attack complexity is high because the attacker must identify an includable file whose contents are useful for information disclosure or code execution.

No verified proof-of-concept code is publicly linked in the CVE data. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2024-54376

Indicators of Compromise

HTTP requests to EazyDocs plugin endpoints containing path traversal sequences such as ../ or absolute paths in query parameters
Web server access logs showing authenticated requests with suspicious file parameters referencing wp-config.php, /etc/passwd, or PHP session files
Unexpected PHP execution originating from directories such as wp-content/uploads/ or temporary file locations
New or modified administrative WordPress users following requests to EazyDocs endpoints

Detection Strategies

Inspect WordPress access logs for requests targeting EazyDocs routes with parameters containing filesystem paths or .php references
Monitor for anomalous file inclusion patterns in PHP error logs, including warnings about include() or require() on unexpected paths
Deploy web application firewall rules that flag LFI payloads such as null bytes, traversal sequences, and PHP wrapper schemes (php://, file://)
Correlate authenticated user activity with plugin endpoint access to identify low-privilege accounts probing document routes

Monitoring Recommendations

Track file integrity on wp-content/plugins/eazydocs/ and core PHP files to detect tampering
Alert on new PHP file creation within upload directories, which attackers often stage before triggering inclusion
Baseline normal request volume to EazyDocs endpoints and alert on deviations from authenticated low-privilege accounts

How to Mitigate CVE-2024-54376

Immediate Actions Required

Update the EazyDocs plugin to a version later than 2.8.0 as soon as a fixed release is available from Spider Themes
Audit WordPress user accounts and remove or downgrade unnecessary low-privilege accounts that could be leveraged for exploitation
Review web server and PHP logs for evidence of prior exploitation attempts against EazyDocs endpoints
Restrict administrative and contributor account creation to trusted personnel until patching is confirmed

Patch Information

The vulnerability affects EazyDocs versions up to and including 2.8.0. Consult the Patchstack Vulnerability Report for the current patched version and vendor guidance from Spider Themes.

Workarounds

Deactivate and remove the EazyDocs plugin until a patched version is applied
Configure a web application firewall to block requests to EazyDocs endpoints containing traversal sequences or absolute filesystem paths
Harden PHP with open_basedir restrictions to constrain the directories from which files can be included
Set allow_url_include=Off and allow_url_fopen=Off in php.ini to reduce inclusion attack surface

bash

# Configuration example: PHP hardening in php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"