CVE-2024-9546: WPIDE WordPress Plugin Path Disclosure Flaw

CVE-2024-9546 Overview

The WPIDE – File Manager & Code Editor plugin for WordPress contains a Full Path Disclosure vulnerability in all versions up to and including 3.4.9. The plugin bundles the PHP-Parser library, which outputs parser rebuild command execution results. Unauthenticated attackers can retrieve the full filesystem path of the web application by reaching the exposed script. Full path disclosure is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. The disclosed path is not directly damaging, but it aids reconnaissance and can be chained with other vulnerabilities such as Local File Inclusion or arbitrary file write flaws.

Critical Impact
Unauthenticated remote attackers can retrieve the absolute filesystem path of the WordPress installation, providing reconnaissance data that supports follow-on attacks against the host.

Affected Products

Xplodedthemes WPIDE – File Manager & Code Editor plugin for WordPress
All versions up to and including 3.4.9
Bundled nikic/php-parser grammar rebuild script shipped with the plugin

Discovery Timeline

2024-10-15 - CVE-2024-9546 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9546

Vulnerability Analysis

The WPIDE plugin ships the nikic/php-parser library under its vendor directory. The library includes a grammar rebuild helper script located at vendor/nikic/php-parser/grammar/rebuildParsers.php. When this script is reachable through the web server, its output includes absolute filesystem paths that reveal where the WordPress installation resides on disk.

The leaked path typically follows patterns such as /var/www/html/wp-content/plugins/wpide/... or /home/<user>/public_html/.... Attackers use this data to tailor exploitation payloads for other flaws that require knowledge of the absolute path, including Local File Inclusion, log poisoning, and session file targeting.

This is a reconnaissance-class vulnerability. It does not by itself grant code execution or authentication bypass. Its practical severity increases when combined with a second vulnerability that consumes filesystem path input.

Root Cause

The root cause is the deployment of a development helper script (rebuildParsers.php) inside a web-accessible directory. The script was designed for use during library build steps, not for runtime execution behind a public web server. When invoked over HTTP, the script echoes command execution output containing absolute paths, exposing information covered under [CWE-200].

Attack Vector

Exploitation requires only a network-reachable request to the vulnerable script path. No authentication, user interaction, or elevated privileges are required. An attacker issues an HTTP GET request to the rebuildParsers.php script inside the plugin's vendor directory. The server returns output containing the absolute path of the WordPress installation.

The vulnerability is passive — it discloses information rather than executing attacker-controlled payloads. Chaining with other flaws is required to convert the disclosure into concrete compromise.

Detection Methods for CVE-2024-9546

Indicators of Compromise

HTTP requests to /wp-content/plugins/wpide/vendor/nikic/php-parser/grammar/rebuildParsers.php in web server access logs
Unauthenticated GET requests from unfamiliar IP addresses targeting the plugin's vendor/ directory
Web server responses containing absolute filesystem paths in the response body
Repeated scanning patterns enumerating WordPress plugin vendor scripts

Detection Strategies

Review WordPress plugin inventories for wpide installations at or below version 3.4.9
Search web application firewall logs for requests targeting scripts under vendor/nikic/php-parser/grammar/
Alert on HTTP responses containing absolute filesystem path patterns such as /var/www/, /home/, or C:\inetpub\
Correlate path disclosure requests with subsequent Local File Inclusion or arbitrary file access attempts from the same source

Monitoring Recommendations

Ingest WordPress access and error logs into a centralized logging platform for anomaly analysis
Monitor for reconnaissance sequences that combine plugin enumeration with disclosure probes
Track outbound responses that leak filesystem metadata to unauthenticated clients
Review Wordfence Vulnerability Report for updated detection signatures

How to Mitigate CVE-2024-9546

Immediate Actions Required

Update the WPIDE – File Manager & Code Editor plugin to a version newer than 3.4.9 when available
Restrict access to the WordPress admin interface and plugin management endpoints via IP allowlisting
Block direct HTTP access to the vendor/ directory of the WPIDE plugin at the web server or WAF layer
Audit the WordPress site for additional vulnerable plugins that could be chained with path disclosure

Patch Information

At time of writing, review the vendor's plugin listing for a fix beyond version 3.4.9. Reference the disclosure details in the Wordfence Vulnerability Report and the affected WordPress Parser Script for the exact code location.

Workarounds

Deny web access to the vendor/ subdirectory of the WPIDE plugin using web server rules
Disable PHP display_errors in production and set expose_php = Off in php.ini to minimize related information leakage
Remove or rename the rebuildParsers.php script if the plugin cannot be updated
Deactivate and uninstall the WPIDE plugin if code editing capabilities are not actively required

bash

# Apache: block access to the plugin vendor directory
<Directory "/var/www/html/wp-content/plugins/wpide/vendor">
    Require all denied
</Directory>

# Nginx: deny direct access to vendor scripts
location ~* /wp-content/plugins/wpide/vendor/.*\.php$ {
    deny all;
    return 404;
}