CVE-2024-54380: WP Cookies Enabler Path Traversal Flaw

CVE-2024-54380 Overview

CVE-2024-54380 is a path traversal vulnerability in the Filippo Bodei WP Cookies Enabler plugin for WordPress. The flaw allows PHP Local File Inclusion (LFI) through improper limitation of a pathname to a restricted directory [CWE-22]. All plugin versions from initial release through 1.0.1 are affected. Attackers can include arbitrary PHP files from the server, potentially leading to source code disclosure, sensitive data exposure, or remote code execution if combined with a file upload primitive. The vulnerability requires user interaction and high attack complexity but no authentication, and impacts confidentiality, integrity, and availability.

Critical Impact
Unauthenticated attackers can include local PHP files via crafted path traversal sequences, enabling code execution and sensitive file disclosure on WordPress sites running WP Cookies Enabler <= 1.0.1.

Affected Products

Filippo Bodei WP Cookies Enabler plugin for WordPress
All versions through 1.0.1
WordPress sites with the wp-cookies-enabler plugin installed and active

Discovery Timeline

2024-12-16 - CVE-2024-54380 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54380

Vulnerability Analysis

The WP Cookies Enabler plugin fails to properly sanitize file path parameters passed to PHP file inclusion functions. The plugin accepts user-controlled input that is concatenated into a file path and processed by an include or require statement. Without normalization or allow-list validation, attackers can supply directory traversal sequences such as ../ to escape the intended directory and reference arbitrary files on the host filesystem.

The issue is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. When the included file is interpreted as PHP, this becomes a Local File Inclusion vulnerability with code execution potential. Even when restricted to read operations, attackers can disclose wp-config.php, retrieve database credentials, or read sensitive system files such as /etc/passwd.

The EPSS score of 0.675% reflects current exploitation probability, though WordPress plugin LFI flaws are commonly weaponized by automated scanners.

Root Cause

The root cause is missing input validation on a path parameter consumed by a PHP file inclusion sink. The plugin trusts attacker-supplied input and passes it directly into functions such as include, require, include_once, or require_once without canonicalization, allow-list checks, or removal of traversal sequences.

Attack Vector

The attack vector is network-based and requires user interaction, such as a victim clicking a crafted link or visiting an attacker-controlled page that triggers the vulnerable request. The attacker sends an HTTP request containing a path traversal payload targeting the vulnerable plugin endpoint. The server resolves the manipulated path and includes the targeted file. If the included file contains PHP code, including log files, uploaded media, or session data poisoned by the attacker, arbitrary code execution becomes possible.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Database Entry for additional technical context.

Detection Methods for CVE-2024-54380

Indicators of Compromise

HTTP requests to wp-content/plugins/wp-cookies-enabler/ endpoints containing ../, ..%2f, or URL-encoded traversal sequences
Web server access logs showing parameters referencing sensitive files such as wp-config.php, /etc/passwd, or PHP session files
Unexpected PHP errors referencing include() or require() with non-standard file paths
Outbound network connections from the PHP worker process to attacker infrastructure following suspicious inclusion requests

Detection Strategies

Inspect WordPress access logs for query parameters containing directory traversal patterns directed at the WP Cookies Enabler plugin path
Deploy web application firewall rules that block traversal sequences and known LFI payloads targeting WordPress plugin endpoints
Monitor the PHP open_basedir violation logs for attempted access outside the WordPress document root
Hash-verify plugin files to detect tampering or unauthorized modification

Monitoring Recommendations

Enable verbose access logging on the WordPress front-end web server and forward logs to a centralized analytics platform
Alert on repeated 200 responses for requests containing traversal characters against plugin endpoints
Track file integrity for wp-config.php and other sensitive files commonly targeted by LFI exploitation
Correlate suspicious PHP process activity, such as outbound connections or spawned shells, with prior HTTP requests to the plugin

How to Mitigate CVE-2024-54380

Immediate Actions Required

Deactivate and remove the WP Cookies Enabler plugin until a patched release is verified
Audit web server and WordPress logs for prior exploitation attempts against the plugin path
Rotate database credentials, WordPress salts, and any secrets stored in wp-config.php if compromise is suspected
Apply a web application firewall ruleset blocking path traversal patterns against /wp-content/plugins/wp-cookies-enabler/

Patch Information

At the time of publication, no fixed version is identified in the advisory. Versions through 1.0.1 are affected. Monitor the Patchstack Vulnerability Database Entry and the WordPress plugin repository for an updated release addressing CVE-2024-54380.

Workarounds

Remove the wp-cookies-enabler plugin directory from wp-content/plugins/ until a patched version is released
Configure PHP open_basedir to restrict file access to the WordPress installation directory
Disable PHP functions such as include and require accepting remote or user-controlled paths via application-level controls
Enforce least-privilege filesystem permissions so the web server user cannot read sensitive system files

bash

# Configuration example: restrict PHP file inclusion scope via php.ini
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off