CVE-2024-50457
📋 TL;DR
This vulnerability allows attackers to include arbitrary local files in WordPress sites using the Qode Essential Addons plugin. Attackers can potentially read sensitive files or execute code by manipulating file inclusion parameters. All WordPress sites running vulnerable versions of Qode Essential Addons are affected.
💻 Affected Systems
- Qode Essential Addons for WordPress
📦 What is this software?
Qode Essential Addons by Qodeinteractive
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete site compromise, data theft, and server takeover.
Likely Case
Local file inclusion allowing reading of sensitive configuration files (wp-config.php) and potential information disclosure.
If Mitigated
Limited impact if file permissions are restrictive and web server runs with minimal privileges.
🎯 Exploit Status
Exploitation is straightforward as it involves manipulating URL parameters to include local files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.4 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find Qode Essential Addons. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.6.4+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate Qode Essential Addons until patched
wp plugin deactivate qode-essential-addons
Restrict file inclusion
linuxAdd web server rules to block file inclusion attempts
# Apache: Add to .htaccess
RewriteCond %{QUERY_STRING} (.*)include(.*)
RewriteRule .* - [F,L]
# Nginx: Add to server block
if ($args ~* "include") { return 403; }
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block file inclusion patterns
- Restrict web server permissions to prevent reading sensitive files
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Qode Essential Addons version. If version is 1.6.3 or lower, you are vulnerable.Check Version:
wp plugin get qode-essential-addons --field=versionVerify Fix Applied:
Verify plugin version is 1.6.4 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with 'include' or 'require' parameters in query strings
- Access to sensitive files like wp-config.php from web requests
Network Indicators:
- Unusual file paths in URL parameters
- Multiple requests with varying file inclusion attempts
SIEM Query:
web.url:*include* OR web.url:*require* AND web.url:*qode-essential-addons*