Login Sign Up

CVE-2024-12272

8.8 HIGH
Remote Code Execution

📋 TL;DR

This vulnerability allows authenticated WordPress users with Contributor-level access or higher to perform Local File Inclusion attacks through the WP Travel Engine Elementor Widgets plugin. Attackers can include and execute arbitrary PHP files on the server, potentially leading to remote code execution, data theft, or privilege escalation. All WordPress sites using this plugin up to version 1.3.7 are affected.

💻 Affected Systems

Products:
  • WP Travel Engine - Elementor Widgets WordPress Plugin
Versions: All versions up to and including 1.3.7
Operating Systems: All operating systems running WordPress
Default Config Vulnerable: ⚠️ Yes
Notes: Requires authenticated user with at least Contributor role. WordPress multisite installations are also vulnerable.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:
  1. Review the CVE details at NVD
  2. Check vendor security advisories for your specific version
  3. Test if the vulnerability is exploitable in your environment
  4. Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full server compromise via remote code execution, data exfiltration, backdoor installation, and complete site takeover.

🟠

Likely Case

Unauthorized file access, sensitive data leakage, privilege escalation to administrator, and potential malware injection.

🟢

If Mitigated

Limited impact if file uploads are restricted and proper access controls prevent file inclusion exploitation.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: LIKELY
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires authenticated access but is straightforward once credentials are obtained. The vulnerability is in multiple widgets within the plugin.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.3.8

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3212458%40wte-elementor-widgets&new=3212458%40wte-elementor-widgets&sfp_email=&sfph_mail=

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'WP Travel Engine - Elementor Widgets'. 4. Click 'Update Now' if available, or download version 1.3.8+ from WordPress repository. 5. Activate the updated plugin.

🔧 Temporary Workarounds

Disable Plugin

all

Temporarily disable the vulnerable plugin until patching is possible

wp plugin deactivate wte-elementor-widgets

Restrict User Roles

all

Remove Contributor and higher roles from untrusted users

🧯 If You Can't Patch

  • Disable the WP Travel Engine Elementor Widgets plugin immediately
  • Implement strict file upload restrictions and disable PHP execution in upload directories

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for 'WP Travel Engine - Elementor Widgets' version 1.3.7 or lower

Check Version:

wp plugin get wte-elementor-widgets --field=version

Verify Fix Applied:

Verify plugin version is 1.3.8 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

  • Unusual file inclusion requests in web server logs
  • PHP execution attempts from unexpected file paths
  • Multiple failed authentication attempts followed by successful Contributor login

Network Indicators:

  • HTTP requests containing file inclusion parameters to plugin endpoints
  • Unusual outbound connections from web server after file inclusion

SIEM Query:

source="web_server_logs" AND (uri="*wte-elementor-widgets*" AND (param="*file*" OR param="*include*"))

📊 Metadata

CVE ID: CVE-2024-12272
CVSS v3 Score: 8.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-98
Published: December 25, 2024
Last Updated: December 25, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-12272, you might also want to check these:

CVE-2025-25174 10.0

This CVE describes a PHP Local File Inclusion vulnerability in the BeeTeam368 Extensions WordPress p...

Same vulnerability type (CWE-98)
CVE-2025-49994 9.8

This vulnerability allows attackers to include local files on the server through improper filename c...

Same vulnerability type (CWE-98)
CVE-2025-50003 9.8

This vulnerability allows attackers to include local PHP files through improper filename control in ...

Same vulnerability type (CWE-98)