CVE-2024-37547
📋 TL;DR
This CVE describes a path traversal vulnerability in the Livemesh Addons for Elementor WordPress plugin. It allows attackers to read arbitrary files on the server by manipulating file paths. All WordPress sites using affected versions of this plugin are vulnerable.
💻 Affected Systems
- Livemesh Addons for Elementor WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like wp-config.php (containing database credentials), followed by database takeover and potential remote code execution.
Likely Case
Unauthorized access to sensitive configuration files, potentially exposing database credentials, API keys, and other secrets stored in readable files.
If Mitigated
Limited file access restricted to web-accessible directories only, preventing access to critical system files.
🎯 Exploit Status
Path traversal vulnerabilities are typically easy to exploit with publicly available tools. The Patchstack references confirm exploitation details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.4.1 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Livemesh Addons for Elementor'. 4. Click 'Update Now' if update available. 5. Alternatively, download version 8.4.1+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate addons-for-elementor
Web Application Firewall Rule
allBlock path traversal patterns at WAF level
Block requests containing '../', '..\', or similar directory traversal sequences
🧯 If You Can't Patch
- Implement strict file permission controls on sensitive directories
- Deploy web application firewall with path traversal detection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for 'Livemesh Addons for Elementor' version ≤8.4.0Check Version:
wp plugin get addons-for-elementor --field=versionVerify Fix Applied:
Confirm plugin version is 8.4.1 or higher in WordPress plugins list📡 Detection & Monitoring
Log Indicators:
- HTTP requests with '../' sequences in URL parameters
- Access to unusual file paths in web logs
- Failed attempts to access sensitive files like wp-config.php
Network Indicators:
- Unusual file read patterns from single IP
- Requests for known sensitive file paths
SIEM Query:
web_access_logs WHERE url CONTAINS '../' OR url CONTAINS '..\' OR url CONTAINS 'wp-config'🔗 References
- https://patchstack.com/database/vulnerability/addons-for-elementor/wordpress-elementor-addons-by-livemesh-plugin-8-3-7-local-file-inclusion-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/addons-for-elementor/wordpress-elementor-addons-by-livemesh-plugin-8-3-7-local-file-inclusion-vulnerability?_s_id=cve
