CVE-2024-7415: Remember Me Controls Path Disclosure Flaw

CVE-2024-7415 Overview

CVE-2024-7415 is a Full Path Disclosure vulnerability in the Remember Me Controls plugin for WordPress by coffee2code. The flaw affects all versions up to and including 2.0.1. The plugin permits direct access to the PHPUnit bootstrap.php file, which has display_errors enabled. Unauthenticated attackers can request the file over the network to retrieve the absolute filesystem path of the web application. The disclosed path is not exploitable on its own but can support reconnaissance for chained attacks such as local file inclusion or arbitrary file write. This weakness is classified under CWE-200 (Information Exposure) and CWE-209 (Generation of Error Message Containing Sensitive Information).

Critical Impact
Unauthenticated remote attackers can retrieve the absolute installation path of a WordPress site running Remember Me Controls 2.0.1 or earlier, aiding follow-on exploitation.

Affected Products

Coffee2code Remember Me Controls plugin for WordPress, versions up to and including 2.0.1
WordPress sites shipping the plugin's tests/phpunit/bootstrap.php in a web-accessible directory
Environments where the PHP display_errors directive is enabled at runtime

Discovery Timeline

2024-09-06 - CVE-2024-7415 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7415

Vulnerability Analysis

The vulnerability resides in the plugin's PHPUnit test harness at tests/phpunit/bootstrap.php. This file is shipped inside the plugin directory and remains reachable through the web server. Requesting the file directly triggers PHP execution outside of the intended WordPress bootstrap context. Because the script sets display_errors to on and references undefined constants or missing includes, PHP emits warnings that reveal the absolute filesystem path of the plugin. An unauthenticated attacker can issue a single HTTP GET request to obtain this path. The disclosed information reduces attacker uncertainty when crafting exploits for other vulnerabilities that require absolute paths, such as log poisoning, include-based LFI, or upload-directory targeting.

Root Cause

The root cause is the inclusion of a developer-oriented PHPUnit bootstrap script inside a publicly accessible plugin directory. The script was designed to run in a CLI test environment where verbose error output is expected. Deploying it to production WordPress installations exposes runtime warnings to any HTTP client. This condition maps to [CWE-209], where sensitive error messages are generated and returned to unauthorized users.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends an HTTP request to /wp-content/plugins/remember-me-controls/tests/phpunit/bootstrap.php. The server executes the PHP file, encounters undefined dependencies, and returns error output containing the full absolute path of the WordPress installation. No authentication, user interaction, or elevated privileges are required. Refer to the WordPress Plugin PHPUnit Bootstrap source and the Wordfence Vulnerability Analysis for technical detail.

Detection Methods for CVE-2024-7415

Indicators of Compromise

HTTP GET requests to /wp-content/plugins/remember-me-controls/tests/phpunit/bootstrap.php in web server access logs
HTTP 200 responses containing PHP Warning: or Fatal error: strings referencing absolute filesystem paths
Repeated probing of tests/phpunit/ or bootstrap.php paths across multiple plugin directories from the same source IP

Detection Strategies

Search web server and WAF logs for requests targeting bootstrap.php under any plugin's tests/ directory
Alert on outbound responses containing PHP error keywords such as Warning:, Notice:, or absolute paths beginning with /var/www/ or C:\
Run authenticated vulnerability scans that enumerate installed plugin versions and flag Remember Me Controls at 2.0.1 or below

Monitoring Recommendations

Ingest Apache, Nginx, or IIS access logs into a centralized analytics platform for pattern-based detection
Baseline normal access to /wp-content/plugins/ and alert on requests to test, development, or .php files inside plugin subdirectories
Correlate path-disclosure requests with subsequent LFI, RFI, or file upload attempts from the same source

How to Mitigate CVE-2024-7415

Immediate Actions Required

Update the Remember Me Controls plugin to a version above 2.0.1 once the vendor publishes a fixed release
Block direct HTTP access to tests/, phpunit/, and bootstrap.php paths at the web server or WAF layer
Disable the PHP display_errors directive in production php.ini configurations to suppress verbose error output

Patch Information

The vendor addressed the issue through a plugin repository commit tracked at the WordPress Plugin Changeset Update. Site administrators should upgrade through the WordPress plugin management interface once the corresponding release version is available. Verify the installed version under Plugins in the WordPress admin console after applying the update.

Workarounds

Remove the tests/ directory from the deployed plugin folder if it is not required for production
Add web server rules that deny requests matching wp-content/plugins/*/tests/.*\.php$
Set display_errors = Off and log_errors = On in php.ini to keep diagnostic output out of HTTP responses

bash

# Configuration example
# Nginx: block direct access to plugin test harnesses
location ~* /wp-content/plugins/.+/tests/.+\.php$ {
    deny all;
    return 403;
}

# php.ini: disable public error output in production
display_errors = Off
log_errors = On
error_log = /var/log/php/error.log