CVE-2024-56055: WPLMS Path Traversal Vulnerability

CVE-2024-56055 Overview

CVE-2024-56055 is a path traversal vulnerability in the VibeThemes WPLMS plugin for WordPress. The flaw affects the wplms_plugin component and allows an authenticated attacker to traverse directories using .../...// sequences. The issue exists in all WPLMS versions up to and including 1.9.9.5.2. According to the Patchstack advisory, the bug enables arbitrary directory deletion on affected WordPress installations. WPLMS is a widely deployed learning management system (LMS) plugin, making vulnerable sites attractive targets for attackers pursuing data destruction or site takeover.

Critical Impact
Authenticated attackers can traverse the filesystem and delete arbitrary directories, causing loss of site data and potential full compromise of the WordPress installation.

Affected Products

VibeThemes WPLMS WordPress Learning Management System, all versions through 1.9.9.5.2
WordPress sites using the wplms_plugin component
Any deployment relying on WPLMS for course delivery, membership, or e-learning features

Discovery Timeline

2024-12-18 - CVE-2024-56055 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56055

Vulnerability Analysis

The vulnerability is classified as CWE-35: Path Traversal using .../...//. The WPLMS plugin accepts user-supplied path input and fails to normalize traversal sequences before performing filesystem operations. When the plugin processes crafted input containing .../...// patterns, sanitization routines that strip a single ../ leave a residual ../ behind. This allows the attacker to escape the intended working directory.

Because the flaw is reachable over the network and requires only low privileges, an authenticated user with limited WPLMS access can trigger directory operations outside the plugin's designated file scope. No user interaction is required to exploit the flaw.

Root Cause

The root cause is improper sanitization of relative path segments in a file or directory handler within the WPLMS plugin. The sanitization logic removes literal ../ substrings once, rather than recursively normalizing the input. Attackers bypass the filter by embedding .../...//, which collapses into ../ after one pass of naive replacement.

Attack Vector

An attacker authenticated to a vulnerable WordPress site sends a crafted request to a WPLMS endpoint that accepts a path parameter. The malicious payload uses .../...// sequences to reference directories outside the plugin's expected scope. The plugin then performs a delete operation on the resolved path, resulting in arbitrary directory deletion. Successful exploitation can remove WordPress core directories, uploads, or plugin folders, leading to denial of service and potential integrity compromise.

See the Patchstack WordPress Plugin Vulnerability advisory for further technical context.

Detection Methods for CVE-2024-56055

Indicators of Compromise

HTTP requests to WPLMS endpoints containing .../...//, ..%2f, or other encoded traversal patterns in path or filename parameters
Unexpected deletion of directories under wp-content/uploads/, wp-content/plugins/, or WordPress core paths
WordPress error logs showing missing files or broken plugin references after suspicious authenticated activity
Access log entries from low-privilege WPLMS accounts issuing POST requests to file management actions

Detection Strategies

Inspect web server access logs for requests containing traversal sequences targeting WPLMS AJAX or REST endpoints
Monitor filesystem audit events on the WordPress document root for delete operations initiated by the PHP process
Deploy a web application firewall (WAF) rule that decodes and normalizes path parameters, then blocks residual ../ after normalization
Correlate authenticated session activity with directory removal events to identify insider or compromised-account abuse

Monitoring Recommendations

Enable WordPress file integrity monitoring across wp-content and core directories to alert on unexpected removals
Track the installed WPLMS plugin version across all sites and flag any instance at or below 1.9.9.5.2
Alert on any WPLMS user with subscriber or instructor privileges triggering server-side file operations

How to Mitigate CVE-2024-56055

Immediate Actions Required

Upgrade the WPLMS plugin to a version later than 1.9.9.5.2 as published by VibeThemes
Audit all WPLMS user accounts and revoke unnecessary low-privilege access that could be leveraged for exploitation
Take a full backup of the WordPress site, database, and wp-content directory before applying updates or investigating impact
Review recent access logs for traversal payloads targeting WPLMS endpoints and investigate matching authenticated sessions

Patch Information

VibeThemes has addressed the arbitrary directory deletion issue in a WPLMS release following version 1.9.9.5.2. Refer to the Patchstack advisory for the fixed version and vendor guidance. Apply the update through the WordPress plugin manager or via the vendor's licensed distribution channel.

Workarounds

Restrict access to WPLMS administrative and instructor endpoints with IP allow-lists at the web server or WAF layer
Deploy WAF rules that recursively decode and normalize URI parameters and reject requests containing residual traversal sequences
Set restrictive filesystem permissions on wp-content subdirectories so the PHP worker cannot delete WordPress core paths
Temporarily disable the WPLMS plugin on sites where an immediate upgrade is not possible

bash

# Example ModSecurity rule to block .../...// traversal patterns
SecRule REQUEST_URI|ARGS "@rx \.\.\./\.\.\.//" \
    "id:1056055,phase:2,deny,status:403,\
    msg:'CVE-2024-56055 WPLMS path traversal attempt blocked',\
    logdata:'Matched Data: %{MATCHED_VAR}'"