CVE-2024-32111
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
WordPress versions 4.1 through 6.5.4 on Windows are vulnerable to a path traversal attack, allowing authenticated contributors to read arbitrary HTML files.
Vulnerability
Description
CVE-2024-32111 is a path traversal vulnerability in WordPress, affecting installations running on Windows operating systems. The issue stems from improper input validation when handling file paths, specifically within the HTML file reading functionality accessible to users with Contributor-level access. This flaw allows an attacker to use relative path traversal sequences (e.g., ../) to break out of the intended directory and access files outside the allowed scope [1][2].
Exploitation
Prerequisites and Method
To exploit this vulnerability, an attacker must have a Contributor role or higher on a WordPress site hosted on Windows. The attack is performed by sending a crafted request that includes path traversal characters in a parameter used to read HTML files. No other authentication or network position is required beyond the Contributor account. The vulnerability is specific to the way WordPress handles file paths on Windows, where backslashes and drive letters may be interpreted differently than on Unix-based systems [1][2].
Impact
A successful exploit allows the attacker to read arbitrary HTML files from the server's file system. This could include sensitive configuration files, templates, or other HTML files containing secrets such as database credentials or API keys, leading to further compromise of the site or server. The vulnerability does not allow arbitrary file write or code execution directly, but the information disclosure can be a significant stepping stone for more severe attacks [2].
Mitigation and
Status
The vulnerability has been patched in WordPress version 6.5.5, released on June 25, 2024. Users are strongly advised to update their sites immediately, as this is a security release also addressing other vulnerabilities. For sites that cannot be updated, no official workaround is provided, but given the Windows-only nature, hosting providers may implement server-level restrictions to mitigate the risk [1][2].
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.