CVE-2024-13593
Published: 23 January 2025
Summary
CVE-2024-13593 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Bmltenabled Meeting Map. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-13593 is a Local File Inclusion (LFI) vulnerability affecting the BMLT Meeting Map plugin for WordPress in all versions up to and including 2.6.0. The flaw exists in the 'bmlt_meeting_map' shortcode, which improperly handles file inclusion, enabling the inclusion and execution of arbitrary files on the server. It is classified under CWE-98 with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability remotely over the network. By crafting a malicious shortcode, they can include arbitrary server files, leading to PHP code execution if those files contain executable content. This allows attackers to bypass access controls, extract sensitive data, or achieve remote code execution, particularly when combined with file upload features for seemingly safe types like images.
Advisories from Wordfence detail the vulnerability and recommend updating to a patched version of the plugin beyond 2.6.0. The WordPress plugin trac repository shows the fix in changeset 3226454, with relevant code changes around line 510 in meeting_map.php, confirming mitigation through input validation improvements in the shortcode handler. Security practitioners should audit sites using the plugin, enforce least-privilege roles, and monitor for anomalous shortcode usage.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51682
Vulnerability details
The BMLT Meeting Map plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.0 via the 'bmlt_meeting_map' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and…
more
execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress plugin shortcode directly enables remote exploitation for code execution and data access on a web server.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validating shortcode inputs to prevent local file inclusion attacks like the improper file handling in the bmlt_meeting_map shortcode.
SI-2 mandates identifying, reporting, and correcting flaws such as this LFI vulnerability by updating the plugin beyond version 2.6.0.
AC-6 enforces least privilege to restrict Contributor-level access, limiting who can insert malicious shortcodes that exploit the LFI vulnerability.