CVE-2024-24869
📋 TL;DR
This path traversal vulnerability in BoldGrid Total Upkeep WordPress plugin allows attackers to download arbitrary files from the server by manipulating file paths. It affects all WordPress sites running Total Upkeep versions up to 1.15.8. Attackers can potentially access sensitive configuration files, database credentials, and other restricted content.
💻 Affected Systems
- BoldGrid Total Upkeep WordPress Plugin
📦 What is this software?
Total Upkeep by Boldgrid
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through retrieval of sensitive files like wp-config.php containing database credentials, leading to database takeover, code execution, or site defacement.
Likely Case
Unauthorized access to sensitive files including configuration files, logs, and backup archives, potentially exposing credentials and site data.
If Mitigated
Limited impact with proper file permissions and web server restrictions, though sensitive files may still be exposed if accessible via web user.
🎯 Exploit Status
Exploitation requires minimal technical skill. Public proof-of-concept demonstrates file download capability via crafted requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.15.9 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/boldgrid-backup/wordpress-total-upkeep-plugin-1-15-8-arbitrary-file-download-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find BoldGrid Total Upkeep. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.15.9+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the Total Upkeep plugin until patched
wp plugin deactivate boldgrid-backup
Web Server Restrictions
allAdd web server rules to block traversal attempts
# Apache: <LocationMatch "\\.\\.\\."> Require all denied </LocationMatch>
# Nginx: location ~* \\.\\.\\. { deny all; }
🧯 If You Can't Patch
- Disable the Total Upkeep plugin immediately
- Implement web application firewall rules to block path traversal patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress plugin version via admin panel or wp-content/plugins/boldgrid-backup/readme.txtCheck Version:
wp plugin get boldgrid-backup --field=versionVerify Fix Applied:
Confirm plugin version is 1.15.9 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '..' or '../' patterns to plugin endpoints
- Unusual file access patterns from single IPs
Network Indicators:
- Requests to /wp-content/plugins/boldgrid-backup/ with traversal sequences
- Abnormal file download patterns
SIEM Query:
web.url:*boldgrid-backup* AND web.url:*..*