CVE-2024-33557 – This CVE describes a path traversal vulnerabili... (How to Fix)

Q: What is the severity of CVE-2024-33557?

CVE-2024-33557 has a CVSS score of 8.5 (HIGH). This CVE describes a path traversal vulnerability in the XStore Core WordPress plugin that allows attackers to include arbitrary local PHP files. This affects all WordPress sites running XStore Core versions up to 5.3.8, potentially leading to remote code execution.

📋 TL;DR

This CVE describes a path traversal vulnerability in the XStore Core WordPress plugin that allows attackers to include arbitrary local PHP files. This affects all WordPress sites running XStore Core versions up to 5.3.8, potentially leading to remote code execution.

💻 Affected Systems

Products:

XStore Core WordPress Plugin

Versions: All versions up to and including 5.3.8

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Affects WordPress installations with XStore Core plugin enabled. No special configuration required.

📦 What is this software?

Xstore Core by 8theme

View all CVEs affecting Xstore Core →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data exfiltration, or ransomware deployment

🟠

Likely Case

Local file inclusion allowing sensitive file disclosure (configuration files, credentials) or limited code execution

🟢

If Mitigated

Unauthorized file read access if proper file permissions restrict execution

🌐 Internet-Facing: HIGH - WordPress plugins are typically internet-facing and this vulnerability requires no authentication

🏢 Internal Only: MEDIUM - Internal systems could still be targeted via phishing or compromised internal accounts

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Path traversal vulnerabilities are well-understood and easy to exploit. Public details available on Patchstack.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 5.3.9 or later

Vendor Advisory: https://patchstack.com/database/vulnerability/et-core-plugin/wordpress-xstore-core-plugin-5-3-5-local-file-inclusion-vulnerability

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find XStore Core and update to version 5.3.9 or later. 4. Verify update completes successfully.

🔧 Temporary Workarounds

Disable XStore Core Plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate et-core-plugin

Web Application Firewall Rule

all

Block path traversal patterns in requests

Add WAF rule to block requests containing '../' or similar path traversal sequences

🧯 If You Can't Patch

Implement strict file permissions (644 for files, 755 for directories) to limit damage
Deploy web application firewall with path traversal detection rules

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Installed Plugins for XStore Core version

Check Version:

wp plugin get et-core-plugin --field=version

Verify Fix Applied:

Verify XStore Core version is 5.3.9 or higher in WordPress admin

📡 Detection & Monitoring

Log Indicators:

HTTP requests containing '../' sequences to WordPress admin-ajax.php or similar endpoints
Unusual file access patterns in PHP error logs

Network Indicators:

HTTP requests with path traversal payloads (../../etc/passwd, etc.)

SIEM Query:

web.url:*../* AND (web.url:*admin-ajax* OR web.url:*wp-admin*)

📊 Metadata

CVE ID: CVE-2024-33557

CVSS v3 Score: 8.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-22

Published: June 4, 2024

Last Updated: February 26, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-33557, you might also want to check these: