CVE-2024-56286 Overview
CVE-2024-56286 is a path traversal vulnerability in the webcodingplace Classic Addons – WPBakery Page Builder plugin for WordPress. The flaw affects all versions up to and including 3.0. Attackers can abuse improper pathname validation to trigger PHP Local File Inclusion (LFI) on vulnerable WordPress sites. The weakness is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Exploitation requires network access and low-level authenticated privileges. Successful attacks compromise confidentiality, integrity, and availability of the target site.
Critical Impact
An authenticated attacker can include arbitrary PHP files on the server, potentially leading to sensitive data disclosure and remote code execution when combined with a writable file upload path.
Affected Products
- Classic Addons – WPBakery Page Builder (classic-addons-wpbakery-page-builder-addons) versions up to and including 3.0
- WordPress installations with the plugin activated
- Sites permitting low-privileged authenticated users to access plugin functionality
Discovery Timeline
- 2025-01-07 - CVE-2024-56286 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-56286
Vulnerability Analysis
The plugin fails to properly restrict user-supplied input used to construct file paths. An authenticated attacker supplies traversal sequences such as ../ to escape the intended directory and reference arbitrary files on the server. PHP then includes and executes the referenced file within the WordPress request context.
Because PHP include/require executes the target file as PHP code, LFI on a WordPress host can escalate to remote code execution. Attackers commonly chain LFI with log poisoning, session file injection, or writable media uploads to achieve execution.
Root Cause
The root cause is missing sanitization and canonicalization of path parameters passed to file inclusion functions. The plugin does not enforce an allowlist of permitted files, does not strip ../ sequences, and does not resolve paths against a fixed base directory before use. The behavior maps to CWE-22.
Attack Vector
Exploitation is remote and requires authentication. An attacker sends a crafted HTTP request to a plugin endpoint that accepts a file or template parameter. The parameter contains directory traversal characters pointing to an arbitrary path such as wp-config.php or a writable log file. The plugin resolves the tampered path and passes it to PHP, which loads and executes the referenced content.
Additional technical details are available in the Patchstack Vulnerability Report.
Detection Methods for CVE-2024-56286
Indicators of Compromise
- HTTP requests to Classic Addons plugin endpoints containing traversal sequences such as ../, ..%2f, or URL-encoded variants
- Access to sensitive files including wp-config.php, /etc/passwd, or PHP session files through plugin parameters
- Unexpected PHP process activity spawned from the plugin directory wp-content/plugins/classic-addons-wpbakery-page-builder-addons/
- New administrator accounts or modified WordPress options following suspicious plugin requests
Detection Strategies
- Inspect web server access logs for requests to plugin endpoints containing .., null bytes, or encoded traversal patterns
- Enable WordPress audit logging and correlate low-privilege user activity with unusual plugin parameter values
- Deploy a Web Application Firewall (WAF) rule to flag path traversal signatures targeting WordPress plugin routes
Monitoring Recommendations
- Monitor file access patterns on wp-config.php and other sensitive PHP files outside normal request flow
- Alert on outbound connections from the PHP-FPM or web server process to attacker-controlled hosts
- Track authenticated user sessions that generate requests to plugin endpoints outside typical editor workflows
How to Mitigate CVE-2024-56286
Immediate Actions Required
- Deactivate the Classic Addons – WPBakery Page Builder plugin until a patched release is confirmed installed
- Audit WordPress user accounts and revoke unnecessary privileges from low-trust users
- Rotate WordPress secrets, database credentials, and API keys stored in wp-config.php if exploitation is suspected
- Review web server logs for indicators of exploitation against the affected plugin path
Patch Information
No fixed version is identified in the referenced advisory beyond noting that versions through 3.0 are affected. Site administrators should consult the Patchstack Vulnerability Report and the plugin developer for release updates and apply patches immediately once available.
Workarounds
- Uninstall the plugin if a patched version is not yet available
- Restrict plugin endpoints at the WAF layer by blocking requests containing traversal sequences
- Apply the principle of least privilege so contributor and author roles cannot reach vulnerable plugin functionality
- Set PHP open_basedir to constrain file access to the WordPress installation directory
# Example open_basedir hardening in php.ini or vhost config
php_admin_value[open_basedir] = "/var/www/html/:/tmp/"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
