CVE-2024-54291
Published: 28 March 2025
Summary
CVE-2024-54291 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely patching of the vulnerable PluginPass plugin versions <=0.9.10 to remediate the path traversal flaw.
Prevents exploitation by validating and sanitizing web inputs used in file system calls to block path traversal attempts.
Limits the impact of arbitrary file download and deletion by enforcing least privilege on the web server process handling the vulnerable plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing WordPress plugin enables remote exploitation (T1190) with arbitrary file download (T1005) and deletion (T1070.004, T1485).
NVD Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 PluginPass pluginpass-pro-plugintheme-licensing allows Manipulating Web Input to File System Calls.This issue affects PluginPass: from n/a through <= 0.9.10.
Deeper analysisAI
CVE-2024-54291 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, classified as CWE-22, in the labs64 PluginPass WordPress plugin (pluginpass-pro-plugintheme-licensing). It enables manipulation of web input to file system calls and affects all versions from n/a through 0.9.10.
Remote attackers can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N). The issue results in a scope change (S:C) with high availability impact (A:H) and a CVSS v3.1 base score of 8.6, allowing arbitrary file download and deletion capabilities.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/pluginpass-pro-plugintheme-licensing/vulnerability/wordpress-pluginpass-plugin-0-9-10-arbitrary-file-download-delete-vulnerability?_s_id=cve documents this as an arbitrary file download/delete vulnerability in WordPress PluginPass plugin version 0.9.10. Security practitioners should consult the advisory for detailed mitigation and patching guidance.
Details
- CWE(s)