A critical vulnerability in the WPLMS WordPress theme (CVE-2024-10470) has been discovered, exposing websites to significant security risks, including Remote Code Execution (RCE) attacks. The flaw, affecting all versions of the WPLMS Learning Management System (LMS) theme up to version 4.962, arises from inadequate file path validation in the theme’s file handling functions. This vulnerability allows attackers to read and delete arbitrary files on the server, including sensitive configuration files like wp-config.php, which are crucial for the operation of WordPress sites. The CVSS score of 9.8 indicates the severity of the issue, making it a top priority for website administrators to address.
One of the most alarming aspects of this vulnerability is that it can be exploited without authentication and even if the WPLMS theme is inactive. This makes it a critical risk for WordPress websites that use the WPLMS LMS theme, as attackers can send crafted HTTP POST requests to manipulate the server and access or delete important files. Although there has been no evidence of active exploitation, the flaw remains highly exploitable, posing a severe threat to website security and data integrity.
To mitigate the risk, experts recommend immediate action. Administrators should deactivate and remove the WPLMS theme from vulnerable WordPress sites, particularly if the theme is non-essential. Additionally, administrators should tighten file access controls, implement file integrity monitoring to detect unauthorized changes, and regularly back up site data to ensure swift recovery in the event of an attack. Employing a Web Application Firewall (WAF) is also suggested to filter out malicious requests and protect against path traversal exploits targeting the WPLMS vulnerability.
The WPLMS theme vulnerability underscores the need for proactive security measures in the WordPress ecosystem. The issue has been addressed in version 4.963 of the theme, which includes a patch to resolve the flaw. Website administrators using versions prior to 4.963 should prioritize updating to this latest version to protect their sites from potential exploitation. As cyber threats continue to evolve, staying updated with the latest patches and following recommended security practices is essential to safeguarding WordPress environments.
