CVE-2024-7145: JetElements Path Traversal Vulnerability

CVE-2024-7145 Overview

CVE-2024-7145 is a Local File Inclusion (LFI) vulnerability in the JetElements plugin for WordPress, developed by Crocoblock. The flaw affects all versions up to and including 2.6.20 and is exploitable through the progress_type parameter. Authenticated attackers with Contributor-level access or higher can include and execute arbitrary files on the server, resulting in PHP code execution. Attackers can leverage this weakness to bypass access controls, exfiltrate sensitive data, or achieve remote code execution when combined with the ability to upload files such as images. The vulnerability is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated contributors can execute arbitrary PHP code on WordPress sites running vulnerable versions of JetElements, leading to full site compromise.

Affected Products

Crocoblock JetElements plugin for WordPress, all versions up to and including 2.6.20
WordPress sites where contributors or higher-privileged users can access the plugin
Environments allowing file uploads of image or other "safe" file types that can be chained with the LFI

Discovery Timeline

2024-08-16 - CVE-2024-7145 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7145

Vulnerability Analysis

The JetElements plugin exposes the progress_type parameter to authenticated users, and this parameter is passed into a file inclusion routine without adequate validation. Because the parameter value is used to build a file path, an attacker can supply path traversal sequences or references to arbitrary files present on the server. When the included file contains PHP, the interpreter executes its contents in the context of the web server user. This turns any file upload capability, including image uploads, into a code execution primitive when combined with the LFI. The vulnerability requires only Contributor-level privileges, a role commonly granted to external authors or guest contributors on WordPress sites.

Root Cause

The root cause is improper sanitization of user-supplied input used to construct a filesystem path. The plugin does not restrict the progress_type value to an allow list of expected template identifiers, nor does it validate that the resolved path stays within a safe directory. This matches the classic pattern described by CWE-22.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session at Contributor level or above. The attacker issues a request that reaches the JetElements handler responsible for rendering progress components and supplies a crafted progress_type value pointing to an attacker-controlled or existing PHP file on disk. If the site allows media uploads, the attacker can first upload a PHP payload disguised as an image and then reference it through the vulnerable parameter to trigger execution. Additional technical detail is available in the Wordfence Vulnerability ID #793f27ec advisory and the Crocoblock JET Elements plugin page.

No verified public proof-of-concept code is referenced in the CVE data. Defenders should treat the vulnerability as exploitable given the low complexity and the availability of technical details in third-party advisories.

Detection Methods for CVE-2024-7145

Indicators of Compromise

Web server access logs containing requests to JetElements endpoints with suspicious progress_type values, including ../ sequences or references to .php files outside expected template paths
New or modified PHP files inside the WordPress wp-content/uploads/ directory or other writable locations
Unexpected outbound connections from the web server process following contributor account activity
Creation of new administrative WordPress accounts or unexpected privilege changes shortly after contributor logins

Detection Strategies

Inspect HTTP request logs for progress_type parameter values containing path traversal characters, absolute paths, or non-standard identifiers
Monitor the WordPress plugins directory and uploads directory for file integrity changes using host-based file integrity monitoring
Correlate contributor authentication events with subsequent requests to JetElements AJAX handlers to identify anomalous activity chains

Monitoring Recommendations

Enable verbose logging on WordPress and the underlying web server, and forward logs to a centralized analytics platform for retention and query
Alert on PHP process spawning shell utilities such as sh, bash, curl, or wget, which often follows successful LFI-to-RCE chains
Track the installed version of the JetElements plugin across your estate and alert when versions at or below 2.6.20 appear

How to Mitigate CVE-2024-7145

Immediate Actions Required

Update the JetElements plugin to a version later than 2.6.20 on every WordPress instance in the environment
Audit all Contributor, Author, and Editor accounts and remove or disable any that are unused or unrecognized
Review recent uploads in wp-content/uploads/ for files with PHP content or suspicious extensions and remove any that are not legitimate
Rotate credentials and session tokens for accounts that could have interacted with the vulnerable endpoint

Patch Information

Crocoblock addresses the vulnerability in JetElements releases after 2.6.20. Administrators should apply the latest available update from the Crocoblock JetElements plugin page or through the WordPress plugin update mechanism. Confirm the installed version after patching to ensure the fix is in place.

Workarounds

Restrict Contributor and higher role assignments to trusted users only until patching is complete
Deploy a web application firewall rule that blocks requests containing path traversal sequences in the progress_type parameter
Disable PHP execution in the WordPress uploads directory through web server configuration to break the LFI-to-RCE chain
Temporarily deactivate the JetElements plugin if patching cannot be performed promptly

bash

# Example Apache configuration to block PHP execution in uploads
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|php5|php7|phar)$">
        Require all denied
    </FilesMatch>
</Directory>