CVE-2024-6544: Custom Post Limits Path Disclosure Flaw

CVE-2024-6544 Overview

CVE-2024-6544 affects the Custom Post Limits plugin for WordPress, developed by coffee2code. All versions up to and including 4.4.1 expose the full filesystem path of the web application to unauthenticated attackers. The disclosure stems from test bootstrap files shipped with the plugin that leave PHP display_errors enabled. Attackers can request these files directly to trigger errors that reveal absolute server paths. The leaked information is not directly exploitable on its own but assists other attacks by revealing the web root and directory structure. This weakness is classified under CWE-200 and CWE-209.

Critical Impact
Unauthenticated remote attackers can retrieve the absolute filesystem path of the WordPress installation, aiding reconnaissance for chained exploitation.

Affected Products

coffee2code Custom Post Limits plugin for WordPress (all versions)
Custom Post Limits versions through 4.4.1
WordPress sites with the plugin's tests/bootstrap.php reachable via HTTP

Discovery Timeline

2024-09-13 - CVE-2024-6544 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6544

Vulnerability Analysis

The Custom Post Limits plugin ships a PHPUnit test bootstrap file at tests/bootstrap.php in the plugin distribution. This file initializes the test harness and, in the process, executes PHP code that references paths, constants, and includes not present in a production WordPress installation. Because the file leaves display_errors enabled, any resulting warnings or fatal errors are rendered directly in the HTTP response.

When the file is requested over the network, PHP emits error messages containing the absolute server path to the plugin directory. This is a classic information disclosure via error output, tracked as CWE-209: Generation of Error Message Containing Sensitive Information. No authentication is required, and no user interaction is involved.

The disclosed path is reconnaissance material rather than a direct compromise vector. Attackers typically pair full path disclosure with local file inclusion, arbitrary file write, or deserialization flaws that require knowledge of on-disk locations.

Root Cause

The root cause is the deployment of development-only test scaffolding into production plugin releases. The tests/bootstrap.php file was never intended to be web-accessible, yet it is packaged with the plugin and served by the web server. Its use of display_errors compounds the issue by rendering PHP diagnostics inline.

Attack Vector

An unauthenticated attacker sends a direct HTTP GET request to the plugin's test bootstrap file, for example /wp-content/plugins/custom-post-limits/tests/bootstrap.php. PHP attempts to execute the file outside its intended test harness, generates errors referencing undefined constants or missing includes, and returns the absolute filesystem path in the response body. See the WordPress Custom Post Limits Test bootstrap and the Wordfence Vulnerability Analysis for the file layout and error output.

Detection Methods for CVE-2024-6544

Indicators of Compromise

HTTP requests to /wp-content/plugins/custom-post-limits/tests/bootstrap.php in web server access logs
HTTP 200 responses to requests targeting any path containing /tests/bootstrap.php
Response bodies containing PHP Warning, Notice, or Fatal error strings alongside absolute filesystem paths

Detection Strategies

Scan installed WordPress plugins for the presence of custom-post-limits/tests/bootstrap.php and flag versions at or below 4.4.1
Inspect HTTP responses from the plugin path for PHP error output that reveals filesystem paths
Correlate reconnaissance requests to /tests/, /vendor/, and other development directories across plugins

Monitoring Recommendations

Alert on unauthenticated access to any tests/ directory under /wp-content/plugins/
Log and review requests that return response bodies matching regular expressions for absolute Linux (/var/www/...) or Windows (C:\\...) paths
Track EPSS drift for CVE-2024-6544 (currently 0.396%) to prioritize follow-up on WordPress reconnaissance activity

How to Mitigate CVE-2024-6544

Immediate Actions Required

Update the Custom Post Limits plugin to a version later than 4.4.1 once released by the vendor
Block external access to /wp-content/plugins/custom-post-limits/tests/ at the web server or WAF layer
Set display_errors = Off in production php.ini to suppress inline error output
Audit other installed plugins for similar test or bootstrap files exposed to the web

Patch Information

No vendor advisory URL is listed in the CVE record at the time of publication. Monitor the WordPress plugin repository for Custom Post Limits and the Wordfence advisory for a fixed release beyond 4.4.1.

Workarounds

Deny web access to the tests/ directory using an Apache .htaccessDeny from all rule or an equivalent Nginx location block
Delete the tests/ directory from the deployed plugin if PHPUnit is not required in production
Force display_errors = Off and log_errors = On in php.ini so diagnostics are written to logs instead of HTTP responses

bash

# Nginx: block access to the vulnerable test bootstrap
location ~* /wp-content/plugins/custom-post-limits/tests/ {
    deny all;
    return 404;
}

# PHP: disable inline error output in production
# /etc/php/php.ini
display_errors = Off
log_errors = On
error_log = /var/log/php_errors.log