CVE-2021-24453
📋 TL;DR
The Include Me WordPress plugin through version 1.2.1 contains a path traversal vulnerability that allows attackers to read arbitrary files on the server. This can lead to remote code execution through log poisoning techniques, potentially compromising the entire web server. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Include Me WordPress Plugin
📦 What is this software?
Include Me by Include Me Project
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attackers to execute arbitrary code, steal data, install backdoors, and pivot to other systems.
Likely Case
Arbitrary file read leading to sensitive information disclosure (config files, credentials) and potential RCE through log poisoning.
If Mitigated
Limited impact if proper file permissions, web application firewalls, and security monitoring are in place.
🎯 Exploit Status
Path traversal to arbitrary file read is straightforward; RCE requires additional steps like log poisoning.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.2 or later
Vendor Advisory: https://wpscan.com/vulnerability/78575072-4e04-4a8a-baec-f313cfffe829
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Include Me' plugin. 4. Click 'Update Now' if update available. 5. If no update, deactivate and delete the plugin.
🔧 Temporary Workarounds
Disable vulnerable plugin
allDeactivate and remove the Include Me plugin if patching isn't immediately possible.
wp plugin deactivate include-me
wp plugin delete include-me
Web Application Firewall rule
linuxBlock path traversal attempts in web requests.
# Example ModSecurity rule: SecRule ARGS "\.\./" "id:1001,phase:2,deny,msg:'Path Traversal Attempt'
🧯 If You Can't Patch
- Implement strict file permissions (disable world-readable files, especially logs)
- Deploy web application firewall with path traversal detection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for 'Include Me' version ≤1.2.1Check Version:
wp plugin get include-me --field=versionVerify Fix Applied:
Verify plugin version is 1.2.2 or higher, or plugin is removed entirely📡 Detection & Monitoring
Log Indicators:
- HTTP requests with '../' patterns to plugin endpoints
- Unusual file access attempts in web server logs
Network Indicators:
- GET/POST requests containing path traversal sequences to /wp-content/plugins/include-me/
SIEM Query:
web_access_logs WHERE url CONTAINS '/wp-content/plugins/include-me/' AND (url CONTAINS '../' OR url CONTAINS '..%2F')