CVE-2021-24493
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload malicious files (including PHP scripts) to WordPress sites running the Shopp plugin. This leads to remote code execution, enabling complete system compromise. All WordPress installations with Shopp plugin versions up to 1.4 are affected.
💻 Affected Systems
- WordPress Shopp eCommerce Plugin
📦 What is this software?
Shopp by Ingenesis
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with attacker gaining full administrative access, data theft, malware deployment, and use as attack platform.
Likely Case
Website defacement, data exfiltration, backdoor installation, and cryptocurrency mining malware deployment.
If Mitigated
No impact if proper file upload restrictions and web application firewalls are in place.
🎯 Exploit Status
Simple HTTP POST request with malicious file upload. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.4.1 or later
Vendor Advisory: https://wpscan.com/vulnerability/dcc7be04-550b-427a-a14f-a2365d96a00e
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Shopp plugin and click 'Update Now'. 4. Verify version is 1.4.1 or higher.
🔧 Temporary Workarounds
Disable Shopp Plugin
linuxTemporarily disable the vulnerable plugin until patching is possible.
wp plugin deactivate shopp
Web Application Firewall Rule
allBlock requests to the vulnerable AJAX endpoint.
# Add to .htaccess: RewriteRule ^wp-admin/admin-ajax\.php\?action=shopp_upload_file - [F,L]
🧯 If You Can't Patch
- Implement strict file upload validation at web server level
- Deploy web application firewall with specific rules blocking shopp_upload_file requests
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Shopp version. If version is 1.4 or lower, you are vulnerable.Check Version:
wp plugin get shopp --field=versionVerify Fix Applied:
Confirm Shopp plugin version is 1.4.1 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=shopp_upload_file
- File uploads with .php extension to upload directories
- Unusual file creation in wp-content/uploads/shopp/
Network Indicators:
- HTTP POST to admin-ajax.php with shopp_upload_file parameter
- File uploads bypassing normal WordPress media upload flow
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin-ajax.php" AND post_data="*shopp_upload_file*"