CVE-2024-6553
📋 TL;DR
The WP Meteor Website Speed Optimization Addon plugin for WordPress versions up to 3.4.3 contains a full path disclosure vulnerability. Unauthenticated attackers can retrieve the web application's full file system path, which can aid in exploiting other vulnerabilities. This affects all WordPress sites using the vulnerable plugin versions.
💻 Affected Systems
- WP Meteor Website Speed Optimization Addon for WordPress
📦 What is this software?
Wp Meteor by Wp Meteor
⚠️ Risk & Real-World Impact
Worst Case
Full path disclosure combined with another vulnerability could lead to remote code execution, data theft, or complete site compromise.
Likely Case
Attackers gather reconnaissance information to facilitate more targeted attacks against the WordPress installation.
If Mitigated
Path information is exposed but cannot be leveraged without additional vulnerabilities.
🎯 Exploit Status
Exploitation requires accessing specific test files left by the plugin with display_errors enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.4
Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3117899%40wp-meteor&new=3117899%40wp-meteor&sfp_email=&sfph_mail=
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP Meteor and click 'Update Now'. 4. Verify version is 3.4.4 or higher.
🔧 Temporary Workarounds
Remove test files manually
linuxDelete the test files left by the wpdesk framework that have display_errors enabled
find /path/to/wordpress/wp-content/plugins/wp-meteor -name "*test*" -type f -delete
find /path/to/wordpress/wp-content/plugins/wp-meteor -name "*.php" -exec grep -l "display_errors" {} \; -delete
🧯 If You Can't Patch
- Disable the WP Meteor plugin temporarily
- Implement web application firewall rules to block access to test file paths
🔍 How to Verify
Check if Vulnerable:
Check if WP Meteor plugin version is 3.4.3 or lower in WordPress admin panel under Plugins → Installed PluginsCheck Version:
wp plugin list --name=wp-meteor --field=versionVerify Fix Applied:
Verify plugin version is 3.4.4 or higher and test that accessing /wp-content/plugins/wp-meteor/test files returns 404 errors📡 Detection & Monitoring
Log Indicators:
- HTTP requests to paths containing '/wp-content/plugins/wp-meteor/test'
- HTTP 200 responses with full server path information in body
Network Indicators:
- Unusual GET requests to plugin test file paths from external IPs
SIEM Query:
source="web_access_logs" AND uri="/wp-content/plugins/wp-meteor/*test*" AND status=200🔗 References
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3117899%40wp-meteor&new=3117899%40wp-meteor&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6197c194-5a17-41da-be79-58a6f5c68a0b?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3117899%40wp-meteor&new=3117899%40wp-meteor&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6197c194-5a17-41da-be79-58a6f5c68a0b?source=cve
