CVE-2024-31280
📋 TL;DR
CVE-2024-31280 is an arbitrary file upload vulnerability in the WordPress Church Admin plugin that allows attackers to upload malicious files to vulnerable websites. This affects all versions up to 4.1.5, potentially leading to complete server compromise.
💻 Affected Systems
- WordPress Church Admin plugin
📦 What is this software?
Church Admin by Church Admin Project
⚠️ Risk & Real-World Impact
Worst Case
Full server takeover via webshell upload leading to data theft, ransomware deployment, or use as attack platform
Likely Case
Website defacement, malware distribution, or credential theft through uploaded malicious scripts
If Mitigated
Limited impact if file uploads are restricted via web application firewall or server configuration
🎯 Exploit Status
Simple HTTP POST request with malicious file upload, no authentication required
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.6 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-4-1-5-arbitrary-file-upload-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find Church Admin plugin
4. Click 'Update Now' if available
5. If no update available, deactivate and delete plugin immediately
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock file uploads to Church Admin endpoints
WAF specific - configure to block POST requests containing file uploads to /wp-content/plugins/church-admin/
Server File Permission Restriction
linuxSet upload directory to read-only
chmod -R 444 /path/to/wp-content/plugins/church-admin/upload/
chown root:root /path/to/wp-content/plugins/church-admin/upload/
🧯 If You Can't Patch
- Immediately deactivate and remove the Church Admin plugin
- Implement strict file upload filtering at web server level (nginx/apache)
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Church Admin version. If version ≤ 4.1.5, vulnerableCheck Version:
wp plugin list --name=church-admin --field=versionVerify Fix Applied:
Confirm Church Admin plugin version is 4.1.6 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /wp-content/plugins/church-admin/
- POST requests with file uploads to plugin endpoints
- Creation of suspicious files (.php, .phtml) in upload directories
Network Indicators:
- HTTP POST requests with file uploads to Church Admin endpoints
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND (uri_path="/wp-content/plugins/church-admin/" AND http_method="POST" AND content_type="multipart/form-data")