CVE-2024-27964
📋 TL;DR
This vulnerability allows attackers to upload arbitrary files to WordPress sites running the Zippy plugin, potentially leading to remote code execution. It affects all versions up to 1.6.9 of the Zippy plugin by Gesundheit Bewegt GmbH. WordPress administrators using this plugin are at risk.
💻 Affected Systems
- WordPress Zippy Plugin by Gesundheit Bewegt GmbH
📦 What is this software?
Zippy by Gesundheit Bewegt
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via webshell upload leading to data theft, ransomware deployment, or site defacement.
Likely Case
Unauthorized file upload leading to backdoor installation, malware distribution, or privilege escalation.
If Mitigated
File upload attempts blocked or logged with no successful exploitation.
🎯 Exploit Status
Exploitation requires some level of access but is technically simple once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.0 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/zippy/wordpress-zippy-plugin-1-6-9-arbitrary-file-upload-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Zippy plugin and click 'Update Now'. 4. Verify update to version 1.7.0 or higher.
🔧 Temporary Workarounds
Disable Zippy Plugin
allTemporarily disable the vulnerable plugin until patching is possible
wp plugin deactivate zippy
Restrict File Uploads via .htaccess
linuxBlock execution of uploaded files in WordPress uploads directory
Add to .htaccess in wp-content/uploads: <Files *.php> deny from all </Files>
🧯 If You Can't Patch
- Remove or disable the Zippy plugin immediately
- Implement web application firewall rules to block file uploads to Zippy endpoints
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for Zippy version ≤1.6.9Check Version:
wp plugin get zippy --field=versionVerify Fix Applied:
Confirm Zippy plugin version is 1.7.0 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to wp-content/uploads via Zippy endpoints
- POST requests to /wp-admin/admin-ajax.php with file upload parameters
Network Indicators:
- HTTP POST requests with file uploads to Zippy-specific endpoints
- Unexpected .php files in uploads directory
SIEM Query:
source="web_server" AND (uri_path="/wp-admin/admin-ajax.php" AND method="POST" AND (user_agent CONTAINS "curl" OR user_agent CONTAINS "wget"))