CVE-2024-29135
📋 TL;DR
This vulnerability allows attackers to upload arbitrary files to WordPress sites running the Tourfic plugin, potentially leading to remote code execution. It affects all Tourfic plugin versions up to 2.11.15. WordPress administrators using vulnerable Tourfic versions are at risk.
💻 Affected Systems
- Tourfic WordPress Plugin
📦 What is this software?
Tourfic by Themefic
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via web shell upload leading to data theft, ransomware deployment, or site defacement.
Likely Case
Web shell upload enabling backdoor access, file manipulation, and potential privilege escalation.
If Mitigated
File upload attempts blocked or logged with no successful exploitation.
🎯 Exploit Status
Exploitation requires some level of access (likely authenticated), but the vulnerability is straightforward to exploit once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.11.16 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/tourfic/wordpress-tourfic-plugin-2-11-15-arbitrary-file-upload-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Tourfic plugin. 4. Click 'Update Now' if update available. 5. If no update available, download version 2.11.16+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable Tourfic Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate tourfic
Restrict File Uploads via .htaccess
linuxBlock execution of uploaded files in wp-content/uploads directory.
Add to .htaccess in wp-content/uploads: <Files *.php> deny from all </Files>
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious file uploads.
- Restrict file upload permissions and implement file type validation at the server level.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Tourfic version. If version is 2.11.15 or lower, you are vulnerable.Check Version:
wp plugin get tourfic --field=versionVerify Fix Applied:
Verify Tourfic plugin version is 2.11.16 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to wp-content/uploads, especially .php, .phtml, .phar files
- POST requests to Tourfic plugin endpoints with file upload parameters
Network Indicators:
- HTTP POST requests with file uploads to /wp-content/plugins/tourfic/ endpoints
SIEM Query:
source="web_server" AND (uri_path="/wp-content/plugins/tourfic/*" AND method="POST" AND (file_extension="php" OR file_extension="phtml" OR file_extension="phar"))