CVE-2024-12859
Published: 03 February 2025
Description
The BoomBox Theme Extensions plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8.0 via the 'boombox_listing' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Security Summary
CVE-2024-12859 is a Local File Inclusion (LFI) vulnerability, classified under CWE-98, affecting the BoomBox Theme Extensions plugin for WordPress in all versions up to and including 1.8.0. The flaw exists in the 'boombox_listing' shortcode's 'type' attribute, which fails to properly sanitize user input, allowing the inclusion of arbitrary local files on the server. Published on 2025-02-03, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for confidentiality, integrity, and availability impacts.
Authenticated attackers with contributor-level permissions or higher can exploit this vulnerability remotely without user interaction. By crafting a malicious shortcode, they can include and execute arbitrary files, enabling PHP code execution within those files. This capability allows bypassing access controls, exfiltrating sensitive data, or achieving remote code execution, particularly in environments where PHP file uploads are permitted.
Mitigation guidance is provided in the plugin's official changelog at https://documentation.px-lab.com/boombox/changelog/ and the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c3a647b6-ed9e-402d-9424-2937f7aa8960?source=cve, which detail patches and remediation steps for affected installations.
Details
- CWE(s)