Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'layout_name' parameter. This vulnerability allows authenticated attackers with Author-level access and above, and with post permissions granted by an Administrator, to include and execute arbitrary files on the server. This can lead to the execution of any PHP code in those files.
This vulnerability can have severe impacts: 1. Bypass of access controls: Attackers can potentially access restricted areas of the system. 2. Sensitive data exposure: Attackers may be able to read sensitive files on the server. 3. Code execution: In cases where "safe" file types like images can be uploaded and included, attackers could achieve arbitrary code execution on the server. 4. Privilege escalation: The ability to execute arbitrary PHP code could allow an attacker to elevate their privileges within the system.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is not explicitly mentioned in the provided information. However, given that the vulnerability affects "all versions up to, and including, 7.7" of the WPBakery Visual Composer plugin, it is likely that a patched version higher than 7.7 is available or will be released soon. Users should check for updates and apply them as soon as they become available.
1. Update the WPBakery Visual Composer plugin to a version higher than 7.7 as soon as a patched version is available. 2. Implement the principle of least privilege: Review and restrict user roles and permissions, especially for Author-level access and above. 3. Implement input validation and sanitization for the 'layout_name' parameter to prevent local file inclusion. 4. Consider using Web Application Firewall (WAF) rules to detect and block potential local file inclusion attempts. 5. Regularly audit and monitor file access logs for any suspicious activity. 6. If immediate updating is not possible, consider temporarily disabling the WPBakery Visual Composer plugin until a patch can be applied.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2024-5709. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-5709
A CVSS base score of 8.8 has been assigned.
Detection for the vulnerability has been added to Qualys (152087)