CVE-2024-12885 in Connections Business Directory Plugin
Summary
by MITRE • 01/25/2025
The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server and all their content.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/25/2025
The CVE-2024-12885 vulnerability affects the Connections Business Directory plugin for WordPress, presenting a critical security flaw that enables authenticated attackers with administrator privileges to perform arbitrary directory deletion operations. This vulnerability exists within the plugin's handling of image directory deletion functionality, where inadequate input validation allows malicious actors to manipulate file paths and potentially remove critical server directories. The vulnerability impacts all versions up to and including 10.4.66, making it a widespread concern for WordPress administrators who have not yet updated their installations.
The technical flaw stems from insufficient validation of file paths during the directory deletion process within the plugin's codebase. When administrators attempt to delete connection images, the plugin fails to properly sanitize or validate the directory paths provided by users, creating a path traversal vulnerability. This weakness allows attackers to craft malicious requests that can target any directory on the server filesystem, bypassing normal access controls and permissions. The vulnerability operates at the file system level, directly manipulating the underlying operating system's directory structure without proper authorization checks.
From an operational perspective, this vulnerability poses significant risks to WordPress installations using the affected plugin. Attackers with administrator-level access can leverage this flaw to delete critical directories containing plugin files, theme assets, user data, or even system configuration files. The impact extends beyond simple data loss, as deletion of core directories can lead to complete plugin malfunction, site downtime, or potential system compromise. The arbitrary nature of the deletion means attackers can target any directory path accessible to the web server process, potentially causing cascading failures throughout the WordPress installation and affecting the entire hosting environment.
The vulnerability aligns with CWE-22 Path Traversal and CWE-770 Allocation of Resources Without Limits or Throttling, representing a classic case of insufficient input validation combined with excessive privileges. From an ATT&CK framework perspective, this vulnerability maps to T1059 Command and Scripting Interpreter and T1485 Data Destruction, as attackers can execute destructive operations through the compromised plugin interface. The attack vector requires authentication but not elevated privileges beyond administrator level, making it particularly dangerous in environments where administrators may be compromised through social engineering, credential theft, or other attack vectors.
Organizations should immediately update the Connections Business Directory plugin to version 10.4.67 or later, which contains the necessary patches to address this vulnerability. System administrators should conduct thorough security audits of their WordPress installations to identify all instances of the vulnerable plugin and ensure proper patch management procedures are in place. Additionally, implementing network segmentation, monitoring for unusual directory deletion activities, and maintaining regular backups can provide defense-in-depth measures against potential exploitation of this vulnerability. Regular security assessments and automated vulnerability scanning should be employed to detect similar issues in other plugins and themes that may exhibit similar path validation weaknesses.