CVE-2024-37462 WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.2 - Local File Inclusion vulnerability

What is CVE-2024-37462?

CVE-2024-37462 is a high-severity path traversal vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor, published on 9 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows Path Traversal.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through 1.4.2.

Weakness: CWE-22

Which versions are affected by CVE-2024-37462?

It affects 1 product.

Products include G5plus Ultimate Bootstrap Elements for Elementor.

How do I fix CVE-2024-37462?

No fix has been published for CVE-2024-37462 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-37462 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-37462 exists.

Other vulnerabilities in G5Theme Ultimate Bootstrap Elements for Elementor

• CVE-2024-13545 Bootstrap Ultimate <= 1.4.9 - Unauthenticated Limited Local File Inclusion Critical 9.8
• CVE-2024-43140 WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.4 - Local File Inclusion vulnerability High 7.5
• CVE-2024-2132 Cross-site scripting in Ultimate Bootstrap Elements for Elementor Medium 6.4
• CVE-2024-1398 Ultimate Bootstrap Elements for Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium 6.4
• CVE-2024-10329 Ultimate Bootstrap Elements for Elementor <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-66x4-xvv2-2j4j.