CVE-2024-6568: Flamix Plugin Full Path Disclosure Flaw

CVE-2024-6568 is a full path disclosure flaw in the Flamix WordPress plugin affecting versions up to 3.1.0. Unauthenticated attackers can retrieve application path information to aid other attacks. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-6568 Overview

CVE-2024-6568 is a Full Path Disclosure vulnerability in the Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress. The flaw affects all versions up to and including 3.1.0. The plugin bundles the mobiledetect library without preventing direct access to its files. Unauthenticated attackers can request these files over the network to trigger PHP errors that reveal the absolute filesystem path of the web application. The disclosed path is not directly exploitable on its own but assists attackers who chain it with additional vulnerabilities such as Local File Inclusion or arbitrary file writes. This weakness is classified as Information Exposure [CWE-200].

Critical Impact
Unauthenticated remote attackers can retrieve the absolute server path of a WordPress installation, aiding reconnaissance and exploit chaining against affected sites.

Affected Products

Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress
All versions up to and including 3.1.0
Bundled mobiledetect/mobiledetectlib export scripts within the plugin

Discovery Timeline

2024-08-21 - CVE-2024-6568 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6568

Vulnerability Analysis

The plugin ships the third-party mobiledetect library under includes/vendor/mobiledetect/mobiledetectlib/export/. The exportToJSON.php script inside this directory is directly reachable over HTTP because no .htaccess restriction, index guard, or ABSPATH check prevents standalone execution. When accessed directly, the script executes outside of the expected WordPress bootstrap. Missing dependencies and uninitialized variables trigger PHP runtime errors. If display_errors is enabled on the target server, the error output includes the absolute filesystem path to the plugin file.

Attackers use the disclosed path to fingerprint hosting environments, identify shared hosting patterns, and craft precise payloads for follow-on vulnerabilities that require an absolute path, such as file inclusion or log poisoning.

Root Cause

The root cause is a configuration and design flaw. The plugin author included a vendored library containing standalone example scripts and did not block direct web access to them. Combined with server configurations that echo PHP errors to HTTP responses, this produces predictable Full Path Disclosure. The underlying weakness maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Attack Vector

Exploitation requires only an unauthenticated HTTP request to the vulnerable script path within the plugin directory. No user interaction, authentication, or privileges are required. The attacker issues a GET request to the exported script location and parses the resulting PHP error output for the absolute path string. See the WordPress Plugin Export Script for the reachable file. No verified public exploit code is available; the vulnerability mechanism is described in prose only.

Detection Methods for CVE-2024-6568

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-content/plugins/flamix-bitrix24-and-contact-forms-7-integrations/includes/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php
HTTP 200 responses from the plugin path containing PHP Warning, Fatal error, or Stack trace strings
Response bodies that leak absolute server paths such as /var/www/html/ or /home/<user>/public_html/

Detection Strategies

Review web server access logs for requests targeting files under includes/vendor/mobiledetect/mobiledetectlib/ from external IP addresses
Deploy web application firewall rules that block direct access to .php files inside wp-content/plugins/*/vendor/ paths
Scan installed WordPress plugin inventories for the Flamix plugin at version 3.1.0 or lower

Monitoring Recommendations

Alert on outbound HTTP responses containing filesystem path patterns from WordPress hosts
Correlate reconnaissance-style requests to plugin vendor directories with subsequent Local File Inclusion or upload attempts
Track PHP error log entries generated by direct execution of vendored library scripts

How to Mitigate CVE-2024-6568

Immediate Actions Required

Update the Flamix: Bitrix24 and Contact Form 7 integrations plugin to the latest patched release above 3.1.0
Disable display_errors in php.ini on production WordPress hosts and route errors to a log file instead
Restrict direct HTTP access to plugin vendor directories via web server rules
Audit sites for the Flamix plugin using the Wordfence Vulnerability Report

Patch Information

The plugin maintainer addressed the issue in a subsequent release. Review the WordPress Plugin Changeset for the exact code changes and upgrade to the fixed version through the WordPress plugin manager.

Workarounds

Add an .htaccess file inside includes/vendor/mobiledetect/mobiledetectlib/export/ denying all HTTP requests
Set display_errors = Off and log_errors = On in the PHP configuration for the site
Remove unused example and export scripts shipped with the vendored mobiledetect library

bash

# Apache .htaccess snippet to block direct access to the vulnerable directory
<FilesMatch "\.php$">
  Require all denied
</FilesMatch>