CVE-2024-13545 is a critical (CVSS 9.8) local file inclusion in the Bootstrap Ultimate theme for WordPress, through the path parameter, in versions up to and including 1.4.9. Unauthenticated attackers can include PHP files on the server. Remove or replace the theme.
What's affected
- Bootstrap Ultimate theme (Ultimate Bootstrap Elements for Elementor), all versions up to and including 1.4.9.
The record does not name a fixed version. This theme is sold through a marketplace, so check the item page and changelog for a release newer than the last affected version.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp theme list --format=table | grep -i bootstrap
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Check whether the theme is installed, even if not active, and delete it if you do not use it.
- If you rely on it, look for a version newer than 1.4.9 from the author.
- Disable the PHP allow_url_include setting and review whether php://filter wrappers are needed.
- Look up CVE-2024-13545 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
Local file inclusion happens when a script loads a file chosen by the visitor. The record says an attacker can include PHP files on the server, which runs any PHP code inside them. If php://filter is enabled, the record says the issue may lead directly to remote code execution. If not, the attacker needs a way to place a PHP file on the server.
The reference points at a docs file inside the theme. Themes often ship with files that never needed to be reachable, and removing unused themes cuts that exposure.
This CVE is a local file inclusion flaw (CWE-22, Path Traversal). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
Local file inclusion happens when a script loads a file whose name a visitor controls. For PHP, an included file is executed, so reaching the wrong file can mean running code.
Avoid building file paths from request values. Map allowed names to fixed files instead, and keep the web root free of files that were never meant to be public.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is an inactive theme still risky?
Files of an installed theme remain on disk and may still be reachable. Delete themes you do not use.
What turns this into code execution?
The record says php://filter being enabled can lead directly to RCE, or a way to upload a PHP file.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
