CVE-2024-30231 – This vulnerability allows attackers to upload a... (How to Fix)

Q: What is the severity of CVE-2024-30231?

CVE-2024-30231 has a CVSS score of 9.1 (CRITICAL). This vulnerability allows attackers to upload arbitrary files to WordPress sites running the vulnerable WebToffee Product Import Export for WooCommerce plugin. Attackers can upload malicious files like PHP shells, leading to remote code execution. All WordPress sites using affected plugin versions are vulnerable.

📋 TL;DR

This vulnerability allows attackers to upload arbitrary files to WordPress sites running the vulnerable WebToffee Product Import Export for WooCommerce plugin. Attackers can upload malicious files like PHP shells, leading to remote code execution. All WordPress sites using affected plugin versions are vulnerable.

💻 Affected Systems

Products:

WebToffee Product Import Export for WooCommerce WordPress plugin

Versions: All versions up to and including 2.4.1

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Affects all WordPress installations with the vulnerable plugin enabled.

📦 What is this software?

Product Import Export For Woocommerce by Webtoffee

View all CVEs affecting Product Import Export For Woocommerce →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete site compromise - attackers gain full control of the WordPress installation, can execute arbitrary code, steal data, deface the site, or install persistent backdoors.

🟠

Likely Case

Remote code execution leading to website defacement, data theft, or malware distribution from the compromised site.

🟢

If Mitigated

Limited impact if file uploads are restricted at web server level or if the vulnerable endpoint is not accessible.

🌐 Internet-Facing: HIGH - WordPress sites are typically internet-facing, and the vulnerability requires no authentication.

🏢 Internal Only: LOW - This primarily affects public-facing WordPress installations.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation is straightforward - attackers can upload malicious files without authentication using the plugin's import functionality.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.4.2

Vendor Advisory: https://patchstack.com/database/vulnerability/product-import-export-for-woo/wordpress-product-import-export-for-woocommerce-plugin-2-4-1-arbitrary-file-upload-vulnerability

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find 'Product Import Export for WooCommerce'. 4. Click 'Update Now' if available. 5. Alternatively, download version 2.4.2+ from WordPress repository and replace the plugin files.

🔧 Temporary Workarounds

Disable plugin

all

Temporarily disable the vulnerable plugin until patching is possible

wp plugin deactivate product-import-export-for-woo

Restrict file uploads via .htaccess

linux

Block PHP file uploads to the plugin's upload directory

<FilesMatch "\.(php|php5|php7|phtml|phar)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

🧯 If You Can't Patch

Disable the Product Import Export for WooCommerce plugin immediately
Implement web application firewall rules to block requests to the plugin's file upload endpoints

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for 'Product Import Export for WooCommerce' version 2.4.1 or lower

Check Version:

wp plugin get product-import-export-for-woo --field=version

Verify Fix Applied:

Verify plugin version is 2.4.2 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual file uploads to /wp-content/uploads/ directory
POST requests to /wp-admin/admin-ajax.php with 'action=product_import_export' parameters
Files with .php extension appearing in upload directories

Network Indicators:

HTTP POST requests containing file uploads to WooCommerce import endpoints
Unusual outbound connections from WordPress server after file upload

SIEM Query:

source="web_server" AND (uri_path="/wp-admin/admin-ajax.php" AND post_data CONTAINS "product_import_export") OR (uri_path CONTAINS "/wp-content/uploads/" AND response_code=200 AND file_extension="php")

📊 Metadata

CVE ID: CVE-2024-30231

CVSS v3 Score: 9.1 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-434

Published: March 26, 2024

Last Updated: March 10, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-30231, you might also want to check these: