PT-2025-2212 · WordPress · Bootstrap Ultimate

Aril Aprilio

+1

·

Published

2025-01-24

·

Updated

2025-01-29

·

CVE-2024-13545

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Bootstrap Ultimate theme for WordPress versions up to and including 1.4.9
Description The issue allows unauthenticated attackers to include PHP files on the server via the path parameter, enabling the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution, especially if PHP files can be uploaded and included. If php://filter is enabled on the server, this issue may directly lead to Remote Code Execution.
Recommendations For versions up to and including 1.4.9, consider disabling the path parameter to prevent exploitation until a patch is available. Restrict access to sensitive PHP files to minimize the risk of code execution. Avoid using the path parameter in API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-13545

Affected Products

Bootstrap Ultimate