CVE-2024-13593
Published: 23 January 2025
Description
The BMLT Meeting Map plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.0 via the 'bmlt_meeting_map' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Security Summary
CVE-2024-13593 is a Local File Inclusion (LFI) vulnerability affecting the BMLT Meeting Map plugin for WordPress in all versions up to and including 2.6.0. The flaw exists in the 'bmlt_meeting_map' shortcode, which improperly handles file inclusion, enabling the inclusion and execution of arbitrary files on the server. It is classified under CWE-98 with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability remotely over the network. By crafting a malicious shortcode, they can include arbitrary server files, leading to PHP code execution if those files contain executable content. This allows attackers to bypass access controls, extract sensitive data, or achieve remote code execution, particularly when combined with file upload features for seemingly safe types like images.
Advisories from Wordfence detail the vulnerability and recommend updating to a patched version of the plugin beyond 2.6.0. The WordPress plugin trac repository shows the fix in changeset 3226454, with relevant code changes around line 510 in meeting_map.php, confirming mitigation through input validation improvements in the shortcode handler. Security practitioners should audit sites using the plugin, enforce least-privilege roles, and monitor for anomalous shortcode usage.
Details
- CWE(s)