CVE-2022-24664
📋 TL;DR
CVE-2022-24664 is a critical remote code execution vulnerability in PHP Everywhere WordPress plugin. It allows any user with post editing permissions to execute arbitrary PHP code via metaboxes, potentially leading to complete site compromise. This affects WordPress sites running PHP Everywhere plugin version 2.0.3 or earlier.
💻 Affected Systems
- PHP Everywhere WordPress Plugin
📦 What is this software?
Php Everywhere by Php Everywhere Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to execute arbitrary code, steal data, install backdoors, deface websites, or pivot to other systems.
Likely Case
Unauthorized users with post editing access can execute PHP code to gain administrative privileges, modify site content, or install malware.
If Mitigated
With proper user access controls and plugin updates, risk is limited to authorized users only, but still presents significant threat if those accounts are compromised.
🎯 Exploit Status
Exploitation requires authenticated access to WordPress admin with post editing permissions. Public proof-of-concept code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.4
Vendor Advisory: https://wordpress.org/plugins/php-everywhere/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find PHP Everywhere plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download version 2.0.4+ from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Disable PHP Everywhere Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate php-everywhere
Restrict User Capabilities
allRemove edit_posts capability from non-administrative users
wp user remove-role <username> contributor
wp user remove-role <username> author
wp user remove-role <username> editor
🧯 If You Can't Patch
- Immediately disable PHP Everywhere plugin on all affected WordPress sites
- Implement strict user access controls and review all users with post editing permissions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins → PHP Everywhere version. If version is 2.0.3 or lower, system is vulnerable.Check Version:
wp plugin get php-everywhere --field=versionVerify Fix Applied:
Verify PHP Everywhere plugin version is 2.0.4 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual PHP execution in WordPress metaboxes
- Multiple failed login attempts followed by successful login and plugin modification
- Unexpected file creation in wp-content/plugins/php-everywhere directory
Network Indicators:
- HTTP POST requests to /wp-admin/post.php with PHP code in parameters
- Unusual outbound connections from WordPress server
SIEM Query:
source="wordpress.log" AND ("php-everywhere" OR "metabox" OR "execute_code") AND status=200