CVE-2024-56230 Overview
CVE-2024-56230 is a Local File Inclusion (LFI) vulnerability in the Maidul Dynamic Product Category Grid, Slider for WooCommerce plugin for WordPress. The flaw stems from improper control of a filename used in a PHP include/require statement [CWE-98]. Authenticated attackers can abuse this weakness to load arbitrary local PHP files through the plugin. The issue affects all versions of the plugin up to and including 1.1.3. Successful exploitation can lead to code execution, sensitive file disclosure, and full compromise of the hosting WordPress site.
Critical Impact
An authenticated attacker can include arbitrary local PHP files, potentially leading to remote code execution and full site takeover on affected WordPress installations.
Affected Products
- Maidul Dynamic Product Category Grid, Slider for WooCommerce (plugin slug: dynamic-product-categories-design)
- All versions from unspecified initial release through 1.1.3
- WordPress sites running WooCommerce with the vulnerable plugin installed
Discovery Timeline
- 2024-12-31 - CVE-2024-56230 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-56230
Vulnerability Analysis
The vulnerability is classified as Improper Control of Filename for Include/Require Statement in PHP Program [CWE-98]. The plugin passes attacker-influenced input into a PHP file inclusion function without sufficient sanitization or allow-listing. As a result, an authenticated user can direct the plugin to include arbitrary files present on the server's filesystem. When those files contain PHP, the code executes in the context of the web server user. Attackers can chain this with log poisoning, session file manipulation, or uploaded assets to achieve remote code execution. The EPSS probability is 0.545% at the 43rd percentile as of 2026-08-24.
Root Cause
The root cause is unsafe use of a user-controllable parameter within a PHP include, include_once, require, or require_once call. The plugin does not restrict the resolved path to a fixed template directory. It also does not sanitize traversal sequences such as ../ or enforce a strict allow-list of permitted filenames.
Attack Vector
The attack is network-based and requires low-privileged authentication on the WordPress site. An attacker submits a crafted request to the plugin endpoint that accepts the vulnerable filename parameter. The parameter references a local file path, which the plugin then includes. Because path traversal is not blocked, files outside the intended directory become reachable. Full technical details are available in the Patchstack vulnerability report.
No verified public proof-of-concept code is available. The vulnerability mechanism follows standard PHP LFI patterns where user input flows directly into a file inclusion sink.
Detection Methods for CVE-2024-56230
Indicators of Compromise
- HTTP requests to WordPress endpoints containing parameter values with ../ traversal sequences, absolute filesystem paths, or references to sensitive files such as wp-config.php, /etc/passwd, or /proc/self/environ.
- Unexpected PHP process activity spawned from the plugin directory wp-content/plugins/dynamic-product-categories-design/.
- Access log entries showing authenticated users invoking plugin actions immediately followed by errors referencing missing include paths.
Detection Strategies
- Inspect web server access and error logs for requests targeting the plugin with suspicious file path parameters.
- Deploy web application firewall (WAF) rules that detect path traversal patterns and known LFI payloads in POST bodies and query strings.
- Monitor filesystem access by the PHP process for reads outside the WordPress document root.
Monitoring Recommendations
- Alert on read access to wp-config.php, .htaccess, and other sensitive files from PHP-FPM or Apache worker processes tied to plugin execution.
- Track new file writes into upload directories followed by inclusion requests, which indicates chained LFI-to-RCE attempts.
- Correlate WordPress authentication events with anomalous plugin usage by low-privileged accounts.
How to Mitigate CVE-2024-56230
Immediate Actions Required
- Update the Dynamic Product Category Grid, Slider for WooCommerce plugin to a version above 1.1.3 as soon as a fixed release is available.
- If no patched version exists, deactivate and remove the plugin from all WordPress sites.
- Audit user accounts and revoke unnecessary privileges to reduce the attacker pool able to exploit this authenticated LFI.
- Rotate WordPress secret keys, database credentials, and API tokens if exploitation is suspected.
Patch Information
At the time of publication, the Patchstack advisory lists versions through 1.1.3 as vulnerable. Administrators should consult the plugin page on WordPress.org for the latest release and confirm the fix version before re-enabling.
Workarounds
- Restrict access to WordPress administrative and plugin endpoints using IP allow-listing at the web server or WAF layer.
- Enforce PHP open_basedir restrictions to limit which directories the PHP process can read.
- Disable the plugin until a patched version is confirmed and validated in a staging environment.
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate dynamic-product-categories-design
wp plugin delete dynamic-product-categories-design
# Confirm removal
wp plugin list | grep dynamic-product-categories-design
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
