CVE-2024-10627
📋 TL;DR
The WooCommerce Support Ticket System plugin for WordPress has an unauthenticated arbitrary file upload vulnerability that allows attackers to upload malicious files to the server. This affects all versions up to 17.7 and can lead to remote code execution. Any WordPress site using this plugin is vulnerable.
💻 Affected Systems
- WooCommerce Support Ticket System WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise via remote code execution, data theft, site defacement, and malware distribution.
Likely Case
Webshell upload leading to backdoor persistence, data exfiltration, and further privilege escalation.
If Mitigated
File upload attempts blocked, no code execution possible, but attack attempts may still consume resources.
🎯 Exploit Status
Simple HTTP POST requests can exploit this vulnerability; exploit code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 17.8 or later
Vendor Advisory: https://codecanyon.net/item/woocommerce-support-ticket-system/17930050
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find 'WooCommerce Support Ticket System'. 4. Click 'Update Now' if available. 5. If manual update needed, download version 17.8+ from CodeCanyon and replace plugin files.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate woocommerce-support-ticket-system
Web Application Firewall Rule
linuxBlock requests to the vulnerable ajax endpoint.
# Example mod_security rule: SecRule REQUEST_URI "@contains ajax_manage_file_chunk_upload" "id:1001,deny,status:403"
🧯 If You Can't Patch
- Remove plugin files completely from server
- Implement strict file upload restrictions at web server level
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins → Installed Plugins. If version is 17.7 or lower, you are vulnerable.Check Version:
wp plugin get woocommerce-support-ticket-system --field=versionVerify Fix Applied:
Confirm plugin version is 17.8 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=manage_file_chunk_upload
- File uploads to unusual directories like wp-content/uploads/ with PHP/executable extensions
Network Indicators:
- Unusual POST requests to admin-ajax.php endpoint from unexpected sources
- Traffic patterns showing file uploads to WordPress directories
SIEM Query:
source="web_server" AND uri="/wp-admin/admin-ajax.php" AND method="POST" AND params.action="manage_file_chunk_upload"