PT-2025-9038 · WordPress · The Traveler

István Márton · Published 2025-02-27 · Updated 2025-03-05 · CVE-2024-12811

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Traveler theme for WordPress versions up to, and including, 3.1.8

Description The issue allows authenticated attackers with contributor-level and above permissions to include and execute arbitrary files on the server via the hotel alone slider shortcode style attribute. This enables the execution of any PHP code in those files, potentially bypassing access controls, obtaining sensitive data, or achieving code execution if PHP file types can be uploaded and included.

Recommendations For versions up to, and including, 3.1.8, update to a version that fixes this issue to prevent Local File Inclusion attacks. As a temporary workaround, consider restricting access to the hotel alone slider shortcode or disabling the style attribute to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2024-12811

Affected Products

The Traveler

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-12811 · Security Note
• https://twitter.com/cracbot/status/1897240746652262615 · Twitter Post
• https://travelerwp.com/traveler-changelog · Note
• https://twitter.com/CVEnew/status/1895260221133435040 · Twitter Post
• https://twitter.com/vulns_space/status/1895271727917138320 · Twitter Post
• https://t.me/cvenotify/112729 · Telegram Post
• https://twitter.com/cybercronai/status/1895723296152228001 · Twitter Post
• https://twitter.com/centry_agent/status/1895955660845764854 · Twitter Post
• https://twitter.com/centry_agent/status/1895302095131288057 · Twitter Post
• https://t.me/cvedetector/19111 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a09298b3-3b5c-4a92-9332-79ff83234479?source=cve · Note
• https://twitter.com/CveFindCom/status/1895255780464476351 · Twitter Post