CVE-2021-24962
📋 TL;DR
This vulnerability in WordPress File Upload plugins allows users with Contributor role or higher to perform path traversal attacks via shortcode arguments. Attackers can upload PHP code disguised as images to auto-loaded directories, leading to arbitrary code execution on affected WordPress sites.
💻 Affected Systems
- WordPress File Upload Free
- WordPress File Upload Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attackers to execute arbitrary code, steal data, install backdoors, or pivot to other systems.
Likely Case
Website defacement, data theft, malware distribution, or unauthorized administrative access to the WordPress installation.
If Mitigated
Limited impact if proper file upload restrictions and user role permissions are enforced.
🎯 Exploit Status
Exploitation requires authenticated user with at least Contributor role. Public exploit details available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.16.3
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/2677722
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'WordPress File Upload' plugin. 4. Click 'Update Now' if available, or download version 4.16.3+ from WordPress repository. 5. Activate updated plugin.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the WordPress File Upload plugin until patched
wp plugin deactivate wordpress-file-upload
Restrict user roles
allTemporarily remove Contributor role permissions or restrict file upload capabilities
🧯 If You Can't Patch
- Implement strict file upload validation to block PHP files disguised as images
- Apply web application firewall rules to detect and block path traversal attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins → WordPress File Upload version. If version is below 4.16.3, system is vulnerable.Check Version:
wp plugin get wordpress-file-upload --field=versionVerify Fix Applied:
Confirm plugin version is 4.16.3 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to wp-content/uploads/wp-file-upload directory
- PHP file execution from upload directories
- Path traversal patterns in HTTP requests
Network Indicators:
- POST requests with suspicious file upload parameters
- Requests containing '../' patterns in file paths
SIEM Query:
source="wordpress.log" AND ("path traversal" OR "../" OR "wp-file-upload")