CVE-2021-24171
📋 TL;DR
This vulnerability in the WooCommerce Upload Files WordPress plugin allows attackers to bypass file extension filtering and upload malicious PHP files. It affects WordPress sites using vulnerable versions of the plugin, potentially leading to remote code execution. Attackers can also perform path traversal to upload files to unintended locations.
💻 Affected Systems
- WooCommerce Upload Files WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and website defacement.
Likely Case
Malicious file upload resulting in backdoor installation, data exfiltration, or site takeover.
If Mitigated
Limited impact with proper file upload restrictions and web application firewalls in place.
🎯 Exploit Status
Exploitation requires user interaction to upload files but is technically simple once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 59.4
Vendor Advisory: https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WooCommerce Upload Files. 4. Click 'Update Now' if available. 5. Alternatively, download version 59.4+ from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the WooCommerce Upload Files plugin until patched.
wp plugin deactivate woocommerce-upload-files
Restrict file uploads via .htaccess
linuxBlock PHP file execution in upload directories.
<FilesMatch "\.php$">
Order Allow,Deny
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Disable the WooCommerce Upload Files plugin immediately.
- Implement web application firewall rules to block malicious upload patterns.
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins > Installed Plugins.Check Version:
wp plugin get woocommerce-upload-files --field=versionVerify Fix Applied:
Confirm plugin version is 59.4 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with double extensions like 'file.php.jpg'
- Upload attempts to non-standard directories via path traversal
Network Indicators:
- HTTP POST requests to upload endpoints with manipulated wcuf_file_name or wcuf_current_upload_session_id parameters
SIEM Query:
source="web_logs" AND (uri_path="/wp-admin/admin-ajax.php" OR uri_path LIKE "%/wcuf/%") AND (param_name="wcuf_file_name" AND param_value LIKE "%.php%")🔗 References
- https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194
- https://www.wordfence.com/blog/2021/03/critical-vulnerability-patched-in-woocommerce-upload-files/
- https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194
- https://www.wordfence.com/blog/2021/03/critical-vulnerability-patched-in-woocommerce-upload-files/
