CVE-2024-39651
📋 TL;DR
This vulnerability allows unauthenticated attackers to delete arbitrary files on WordPress sites running the vulnerable WooCommerce PDF Vouchers plugin. Attackers can exploit path traversal flaws to target critical system files, potentially causing complete site compromise. All WordPress sites using affected versions of this plugin are at risk.
💻 Affected Systems
- WordPress WooCommerce PDF Vouchers Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover via deletion of WordPress core files, wp-config.php, or .htaccess, leading to data loss, defacement, or ransomware deployment.
Likely Case
Site disruption through deletion of plugin files, media uploads, or configuration files causing functionality loss and potential data corruption.
If Mitigated
Limited impact if file permissions restrict write access to web user, but still potential for denial of service.
🎯 Exploit Status
Simple HTTP requests with crafted parameters can trigger the vulnerability. Public exploit details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.9.5
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'WooCommerce PDF Vouchers'. 4. Click 'Update Now' if available. 5. Alternatively, download version 4.9.5+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate woocommerce-pdf-vouchers
Restrict File Permissions
linuxSet restrictive permissions on critical WordPress directories
chmod 755 wp-content
chmod 644 wp-config.php
find /var/www/html -type f -exec chmod 644 {} \;
find /var/www/html -type d -exec chmod 755 {} \;
🧯 If You Can't Patch
- Disable WooCommerce PDF Vouchers plugin immediately
- Implement web application firewall (WAF) rules to block path traversal patterns
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins > Installed Plugins. If version is below 4.9.5, you are vulnerable.Check Version:
wp plugin get woocommerce-pdf-vouchers --field=versionVerify Fix Applied:
Confirm plugin version shows 4.9.5 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with ../ sequences in parameters
- File deletion errors in WordPress debug logs
- 404 errors for unexpected file paths
Network Indicators:
- HTTP POST requests to /wp-admin/admin-ajax.php with file deletion parameters
- Unusual file paths in URL parameters
SIEM Query:
source="wordpress.log" AND ("../" OR "..\\" OR "%2e%2e%2f") AND "action=delete_file"