CVE-2024-6499: MaxButtons WordPress Plugin Info Disclosure

CVE-2024-6499 Overview

The MaxButtons plugin for WordPress contains an information exposure vulnerability affecting all versions up to and including 9.7.8. Unauthenticated attackers can retrieve the full server path to plugin instances by interacting with the convert.php script in the Font Awesome 5 library assets. The disclosed path reveals the underlying directory structure of the WordPress installation. On its own, this information has limited direct impact, but attackers can combine it with other vulnerabilities to accelerate reconnaissance and target subsequent attacks. The vulnerability is categorized under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated remote attackers can enumerate full filesystem paths on WordPress sites running vulnerable MaxButtons installations, aiding chained exploitation and reconnaissance.

Affected Products

Maxfoundry MaxButtons for WordPress, all versions through 9.7.8
WordPress installations bundling the MaxButtons Font Awesome 5 asset library
Sites where assets/libraries/font-awesome-5/convert.php is reachable

Discovery Timeline

2024-08-24 - CVE-2024-6499 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6499

Vulnerability Analysis

The MaxButtons plugin ships a helper script at assets/libraries/font-awesome-5/convert.php used to convert Font Awesome icon definitions. The script executes without proper access controls and emits PHP errors or output containing absolute filesystem paths. When accessed directly by an unauthenticated user, the response exposes the server-side installation path of the plugin.

This class of issue is known as full path disclosure. Attackers use the disclosed paths to construct payloads for local file inclusion, log poisoning, arbitrary file write, or PHP object injection attacks that require knowledge of the absolute installation directory. The flaw does not directly grant code execution or data manipulation, which aligns with its confidentiality-only impact profile.

Root Cause

The root cause is an internal utility script placed inside a web-accessible plugin directory without authentication checks or output sanitization. The script triggers PHP warnings or notices that include the absolute path, and it lacks an ABSPATH guard commonly used by WordPress plugin files to prevent direct invocation. See the WordPress MaxButtons Font Converter source for the pre-patch implementation.

Attack Vector

Exploitation requires only an unauthenticated HTTP GET request to the plugin's convert.php endpoint on a vulnerable WordPress site. No user interaction, cookies, or elevated privileges are needed. The attacker parses the HTTP response for filesystem path strings such as /var/www/html/wp-content/plugins/maxbuttons/... and uses these values to seed further attacks against the WordPress host.

No public proof-of-concept exploit or CISA Known Exploited Vulnerabilities entry is associated with this CVE. Technical details are available in the Wordfence Vulnerability Intelligence Report.

Detection Methods for CVE-2024-6499

Indicators of Compromise

Unauthenticated HTTP requests to /wp-content/plugins/maxbuttons/assets/libraries/font-awesome-5/convert.php
HTTP responses containing absolute filesystem paths such as /var/www/, /home/, or C:\inetpub\ served from the plugin path
PHP warning or notice text visible in HTTP responses from the MaxButtons plugin directory
Reconnaissance-style user agents scanning /wp-content/plugins/maxbuttons/ paths

Detection Strategies

Inspect web server access logs for direct requests to convert.php under the MaxButtons plugin directory from external clients.
Add web application firewall (WAF) rules that alert on responses returning PHP path disclosure patterns from plugin URIs.
Correlate path-disclosure requests with follow-on requests targeting wp-config.php, xmlrpc.php, or plugin upload endpoints from the same source IP.

Monitoring Recommendations

Track the installed MaxButtons plugin version across WordPress fleets and flag any instance at or below 9.7.8.
Monitor for HTTP 200 responses to convert.php requests where the response body contains substrings matching filesystem path formats.
Baseline external access to /wp-content/plugins/*/assets/libraries/ paths and alert on deviations.

How to Mitigate CVE-2024-6499

Immediate Actions Required

Upgrade the MaxButtons plugin to version 9.8.0 or later on all WordPress sites.
Block external access to assets/libraries/font-awesome-5/convert.php at the web server or WAF layer until patching completes.
Set the PHP directive display_errors = Off in production to suppress path disclosure through error output.

Patch Information

Maxfoundry released version 9.8.0 which remediates the disclosure by modifying the convert.php helper script. Review the fix in the WordPress MaxButtons Changeset 9.8.0. Administrators should apply the update through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Deny direct HTTP access to the convert.php file using web server configuration (Apache .htaccess or Nginx location block).
Disable or uninstall the MaxButtons plugin if it is not required.
Configure PHP to log errors to file only and never render them in HTTP responses.

bash

# Configuration example
# Nginx: block direct access to the vulnerable helper script
location ~* /wp-content/plugins/maxbuttons/assets/libraries/font-awesome-5/convert\.php$ {
    deny all;
    return 403;
}

# PHP: suppress path disclosure via error output (php.ini)
display_errors = Off
log_errors = On
error_log = /var/log/php/error.log