CVE-2024-13720
📋 TL;DR
The WP Image Uploader WordPress plugin allows unauthenticated attackers to delete arbitrary files on the server due to insufficient file path validation. This vulnerability affects all WordPress sites using WP Image Uploader version 1.0.1 or earlier. Attackers can potentially achieve remote code execution by deleting critical files like wp-config.php.
💻 Affected Systems
- WP Image Uploader WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete site compromise via remote code execution, data theft, defacement, or site destruction by deleting critical system files.
Likely Case
Site disruption or defacement by deleting theme files, configuration files, or uploaded content, potentially leading to downtime.
If Mitigated
Limited impact if proper file permissions and web application firewalls block exploitation attempts.
🎯 Exploit Status
No authentication required, making exploitation trivial for attackers who discover the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 1.0.1
Vendor Advisory: https://plugins.trac.wordpress.org/browser/wp-image-uploader/trunk/index.php#L85
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WP Image Uploader. 4. Click 'Update Now' if update available. 5. If no update, deactivate and delete the plugin immediately.
🔧 Temporary Workarounds
Immediate Plugin Deactivation
WordPressDeactivate the vulnerable plugin to prevent exploitation while planning permanent fix.
wp plugin deactivate wp-image-uploader
🧯 If You Can't Patch
- Deactivate and remove the WP Image Uploader plugin immediately.
- Implement web application firewall rules to block requests to the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for WP Image Uploader version 1.0.1 or earlier.Check Version:
wp plugin get wp-image-uploader --field=versionVerify Fix Applied:
Verify plugin is either updated to version after 1.0.1 or completely removed from the plugins directory.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /wp-content/plugins/wp-image-uploader/ with file deletion parameters
- 404 errors for critical files like wp-config.php
Network Indicators:
- Unusual file deletion requests to the plugin endpoint from unauthenticated sources
SIEM Query:
source="web_server" AND (uri="/wp-content/plugins/wp-image-uploader/" AND method="POST")