CVE-2024-10470

CVE-2024-10470 is a path traversal flaw (CWE-22) in the WPLMS Learning Management System theme for WordPress by vibethemes, where the readfile and unlink functions lack sufficient file path validation and permission checks. An unauthenticated attacker can send network requests that reach these functions to read arbitrary files on the server and, more critically, delete arbitrary files. Deleting the right file, such as wp-config.php, can easily lead to remote code execution, while file reads can expose sensitive server contents. All versions up to and including 4.962 are affected, and the theme remains vulnerable even when it is installed but not activated, so exposure extends beyond actively used installations. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a 34.4% probability of exploitation within 30 days (98th percentile), making this a high-priority patch.

What to do: Update WPLMS to a patched version newer than 4.962 as soon as one is available. Audit every WordPress installation that has the theme installed, including sites where the theme is inactive, and remove or update unused copies. Until patched, monitor logs for unauthenticated requests triggering file read/delete operations and watch for unexpected deletions of critical files such as wp-config.php.