CVE-2024-56049: WPLMS Path Traversal Vulnerability

CVE-2024-56049 Overview

CVE-2024-56049 is a path traversal vulnerability in the VibeThemes WPLMS plugin for WordPress. The flaw affects all versions up to and including 1.9.9.5.2. Authenticated attackers with subscriber-level privileges can exploit .../...// traversal sequences to delete arbitrary files on the server. Successful exploitation leads to arbitrary file deletion, which can disrupt site availability and enable further compromise. The vulnerability is tracked under CWE-35: Path Traversal: '.../...//'.

Critical Impact
Low-privileged authenticated users can delete arbitrary files on the WordPress host, potentially enabling authentication bypass by removing wp-config.php and taking over the site.

Affected Products

VibeThemes WPLMS WordPress Learning Management System plugin
All WPLMS versions from initial release through 1.9.9.5.2
WordPress sites running the wplms_plugin component

Discovery Timeline

2024-12-18 - CVE-2024-56049 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56049

Vulnerability Analysis

The WPLMS plugin fails to properly sanitize user-supplied path input before performing file deletion operations. Attackers submit crafted path sequences containing .../...// patterns that bypass naive traversal filters. These sequences resolve to directories outside the intended plugin scope after path normalization.

An authenticated subscriber, the lowest WordPress role, can invoke the vulnerable endpoint. The plugin then removes files at the attacker-controlled path. Deleting critical files such as wp-config.php triggers WordPress reinstallation flows, which an attacker can hijack to gain administrative control.

The attack requires no user interaction and executes over the network. Impact extends beyond the vulnerable plugin scope, affecting the entire WordPress installation and underlying filesystem.

Root Cause

The root cause is improper neutralization of directory traversal sequences before file deletion. Standard filters that strip ../ do not remove .../...//, which collapses to ../ after normalization. The plugin also fails to enforce capability checks appropriate for destructive filesystem operations, allowing subscribers to invoke functions that should require administrator privileges.

Attack Vector

Exploitation requires network access to the WordPress site and valid subscriber credentials, which are trivially obtainable on sites with open registration. The attacker sends an authenticated HTTP request to the vulnerable WPLMS AJAX or REST endpoint. The request contains a file path parameter with .../...// sequences pointing to a target file outside the plugin directory. The server processes the request and deletes the target file. Refer to the Patchstack vulnerability report for endpoint specifics.

Detection Methods for CVE-2024-56049

Indicators of Compromise

HTTP requests to WPLMS plugin endpoints containing .../...//, ..%2F, or encoded traversal sequences in path parameters
Unexpected deletion or absence of core WordPress files such as wp-config.php, .htaccess, or files under wp-content/
WordPress installation prompts appearing on previously configured sites, indicating wp-config.php removal
Filesystem audit log entries showing file deletions initiated by the web server process outside plugin directories

Detection Strategies

Inspect web server access logs for POST or GET requests to WPLMS endpoints containing traversal patterns and authenticated subscriber session cookies
Deploy web application firewall rules that block requests containing .../...// or double-encoded traversal sequences targeting WordPress plugins
Monitor filesystem integrity using tools such as auditd, tripwire, or AIDE for unauthorized deletions in the WordPress document root

Monitoring Recommendations

Alert on any deletion of wp-config.php, wp-settings.php, or files in wp-includes/ by the web server user
Correlate subscriber-level authentication events with file deletion syscalls to identify low-privilege abuse
Track HTTP 200 responses to WPLMS AJAX actions from newly registered accounts within short timeframes

How to Mitigate CVE-2024-56049

Immediate Actions Required

Update the WPLMS plugin to a version later than 1.9.9.5.2 as soon as the vendor publishes a fixed release
Disable open user registration on WordPress sites running vulnerable WPLMS versions to reduce the attacker pool
Audit existing subscriber accounts and remove unrecognized registrations created in recent weeks
Back up wp-config.php and the full WordPress installation before applying any changes

Patch Information

VibeThemes has not published a confirmed fixed version in the referenced advisory at the time of NVD publication. Site administrators should monitor the Patchstack advisory and the official WPLMS changelog for a patched release above 1.9.9.5.2.

Workarounds

Deactivate the WPLMS plugin until a patched version is available if the LMS functionality is not business-critical
Deploy a virtual patch through a WAF that blocks path traversal payloads targeting /wp-admin/admin-ajax.php and WPLMS REST routes
Restrict filesystem permissions so the PHP process cannot delete files outside wp-content/uploads/
Enforce administrator approval for new user registrations rather than allowing automatic subscriber creation

bash

# Example WAF rule (ModSecurity) to block traversal patterns targeting WPLMS
SecRule REQUEST_URI "@rx (?:\.{3,}/|\.\./|%2e%2e%2f)" \
    "id:1056049,phase:2,deny,status:403,\
    msg:'CVE-2024-56049 WPLMS path traversal attempt',\
    chain"
    SecRule REQUEST_URI "@contains wplms"