CVE-2024-13545: Bootstrap Ultimate <= 1.4.9 - Unauthenticated Limited Local File Inclusion
First published: Fri Jan 24 2025(Updated: )
The Bootstrap Ultimate theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.9 via the path parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If php://filter is enabled on the server, this issue may directly lead to Remote Code Execution.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Twitter Bootstrap | <=1.4.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-13545?
CVE-2024-13545 is considered a high severity vulnerability due to its potential for unauthorized PHP file inclusion and code execution.
How do I fix CVE-2024-13545?
To fix CVE-2024-13545, update the Bootstrap Ultimate theme for WordPress to a version later than 1.4.9.
Who is affected by CVE-2024-13545?
Any users of the Bootstrap Ultimate theme for WordPress in versions up to and including 1.4.9 are affected by CVE-2024-13545.
What type of vulnerability is CVE-2024-13545?
CVE-2024-13545 is a Local File Inclusion vulnerability that allows attackers to include and execute arbitrary PHP files on the server.
Can CVE-2024-13545 be exploited remotely?
Yes, CVE-2024-13545 can be exploited by unauthenticated attackers remotely, which increases its risk.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/description
- agent/references
- agent/first-publish-date
- agent/type
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/source
- agent/author
- agent/tags
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/bootstrap
- canonical/twitter bootstrap