CVE-2024-7412: No Update Nag Full Path Disclosure Flaw

CVE-2024-7412 Overview

The No Update Nag plugin for WordPress contains a Full Path Disclosure vulnerability affecting all versions up to and including 1.4.12. The plugin permits direct access to its bootstrap.php file, which runs with display_errors enabled. Unauthenticated attackers can request this file to trigger PHP errors that reveal the absolute filesystem path of the web application. The disclosed path aids reconnaissance and can amplify the impact of chained vulnerabilities against the target site. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve the absolute server path of a WordPress installation, providing reconnaissance data that enables follow-on exploitation of other vulnerabilities.

Affected Products

Coffee2code No Update Nag plugin for WordPress
All versions up to and including 1.4.12
WordPress sites with the plugin installed and publicly accessible

Discovery Timeline

2024-08-12 - CVE-2024-7412 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7412

Vulnerability Analysis

The No Update Nag plugin ships a bootstrap.php file that is directly reachable over HTTP through the plugin directory. When PHP display_errors is enabled during execution of this file, any warning, notice, or fatal error produced by the interpreter is written into the HTTP response body.

Because the emitted error messages include the absolute filesystem path of the executing script, an unauthenticated attacker can retrieve the web application's installation path with a single GET request. The disclosed information is passive reconnaissance data. It does not itself grant code execution or authentication.

Attackers commonly combine full path disclosure with vulnerabilities that require path knowledge, such as Local File Inclusion, log poisoning, or arbitrary file write flaws where the destination path must be known. The vulnerability is classified under CWE-200.

Root Cause

The root cause is a combination of two conditions. First, the plugin's bootstrap.php is directly web-accessible rather than being loaded exclusively through the WordPress bootstrap chain. Second, the file executes with display_errors on, which sends PHP error output to the client instead of a log file. Requesting the file outside its intended context triggers errors that echo the absolute server path.

Attack Vector

Exploitation is performed over the network with no authentication and no user interaction. An attacker sends an HTTP GET request directly to the plugin's bootstrap.php file under /wp-content/plugins/no-update-nag/. The server response contains PHP error text that includes the full path to the WordPress installation. No exploit tooling is required because the disclosure appears in the plain response body.

The vulnerability affects the confidentiality of environment data only. Integrity and availability of the site are not directly impacted. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-7412

Indicators of Compromise

HTTP GET requests to /wp-content/plugins/no-update-nag/bootstrap.php from unauthenticated clients
HTTP 200 responses containing PHP error strings such as Warning:, Fatal error:, or Notice: alongside absolute filesystem paths
Requests to the plugin path originating from known scanner user-agents or anonymizing infrastructure

Detection Strategies

Inspect web server access logs for direct requests to plugin PHP files that bypass wp-load.php or index.php entry points
Monitor response bodies from the plugin directory for path strings such as /var/www/, /home/, or C:\\inetpub\\ combined with PHP error keywords
Deploy WAF rules that alert on plugin-directory requests returning PHP interpreter errors

Monitoring Recommendations

Correlate full path disclosure signals with subsequent requests targeting Local File Inclusion, log paths, or upload directories against the same host
Track scanner reconnaissance patterns that enumerate WordPress plugin files across multiple sites in a short window
Alert when display_errors output is observed leaving production web servers

How to Mitigate CVE-2024-7412

Immediate Actions Required

Update the No Update Nag plugin to a version above 1.4.12 where the direct-access issue is remediated per the WordPress Changeset
Set PHP display_errors = Off in php.ini on all production hosts and route errors to a log file with log_errors = On
Deactivate the plugin if a patched version cannot be applied immediately

Patch Information

The vendor addressed the vulnerability through the WordPress plugin repository. Refer to the WordPress Changeset Update for the code diff, and confirm the installed plugin version is later than 1.4.12 after upgrade.

Workarounds

Block direct HTTP access to bootstrap.php under the plugin directory using a web server rule
Disable PHP error display globally in php.ini so error output cannot leak filesystem paths to remote clients
Restrict access to /wp-content/plugins/no-update-nag/ at the reverse proxy or WAF layer until patching is complete

bash

# Configuration example: disable PHP error output in production
# /etc/php/php.ini
display_errors = Off
display_startup_errors = Off
log_errors = On
error_log = /var/log/php/error.log

# Apache: deny direct access to the vulnerable file
# /etc/apache2/conf-available/no-update-nag.conf
<Files "bootstrap.php">
    Require all denied
</Files>

# Nginx equivalent
location ~* /wp-content/plugins/no-update-nag/bootstrap\.php$ {
    deny all;
    return 403;
}