CVE-2024-13742 – The iControlWP WordPress plugin is vulnerable t... (How to Fix)

Q: What is the severity of CVE-2024-13742?

CVE-2024-13742 has a CVSS score of 9.8 (CRITICAL). The iControlWP WordPress plugin is vulnerable to PHP object injection via deserialization of untrusted input in the reqpars parameter. This allows unauthenticated attackers to inject PHP objects, but exploitation requires a separate plugin or theme with a POP chain to achieve impact. All WordPress sites using iControlWP versions up to 4.4.5 are affected.

📋 TL;DR

The iControlWP WordPress plugin is vulnerable to PHP object injection via deserialization of untrusted input in the reqpars parameter. This allows unauthenticated attackers to inject PHP objects, but exploitation requires a separate plugin or theme with a POP chain to achieve impact. All WordPress sites using iControlWP versions up to 4.4.5 are affected.

💻 Affected Systems

Products:

iControlWP - Multiple WordPress Site Manager

Versions: All versions up to and including 4.4.5

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with iControlWP plugin. Impact depends on presence of POP chains in other installed plugins/themes.

📦 What is this software?

Icontrolwp by Icontrolwp

View all CVEs affecting Icontrolwp →

⚠️ Risk & Real-World Impact

🔴

Worst Case

If combined with a POP chain from another plugin/theme, attackers could execute arbitrary code, delete files, or steal sensitive data leading to complete site compromise.

🟠

Likely Case

Most sites will have no immediate impact unless they have vulnerable plugins/themes with POP chains installed, but the vulnerability creates a persistent attack surface.

🟢

If Mitigated

With proper plugin management and security controls, the risk is limited to sites with vulnerable POP chain components installed alongside iControlWP.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires finding or developing a POP chain from other installed components. No known POP chain exists in iControlWP itself.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.4.6 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3168478%40worpit-admin-dashboard-plugin&new=3168478%40worpit-admin-dashboard-plugin

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find iControlWP and click 'Update Now'. 4. Verify version is 4.4.6 or higher.

🔧 Temporary Workarounds

Disable iControlWP Plugin

all

Temporarily deactivate the plugin until patched

wp plugin deactivate worpit-admin-dashboard-plugin

Web Application Firewall Rule

all

Block requests containing malicious serialized objects in reqpars parameter

🧯 If You Can't Patch

Remove or disable the iControlWP plugin immediately
Audit and remove any plugins/themes with known POP chains to reduce attack surface

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → iControlWP version. If version is 4.4.5 or lower, you are vulnerable.

Check Version:

wp plugin get worpit-admin-dashboard-plugin --field=version

Verify Fix Applied:

After updating, verify iControlWP version shows 4.4.6 or higher in WordPress plugins list.

📡 Detection & Monitoring

Log Indicators:

HTTP requests containing serialized PHP objects in reqpars parameter
Unusual plugin activation/deactivation events
Unexpected file modifications in wp-content/plugins/worpit-admin-dashboard-plugin

Network Indicators:

POST requests to WordPress endpoints with reqpars parameter containing serialized data
Traffic spikes to /wp-admin/admin-ajax.php or plugin-specific endpoints

SIEM Query:

source="wordpress" AND (uri_path="*admin-ajax.php*" OR uri_path="*wp-admin*" OR uri_path="*worpit*") AND http_method="POST" AND query_string="*reqpars*"

📊 Metadata

CVE ID: CVE-2024-13742

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

EPSS Score: 5.11% exploit probability (89.6th percentile)

Published: January 30, 2025

Last Updated: January 30, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-13742, you might also want to check these: