CVE-2024-56052
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload arbitrary files, including web shells, to WordPress sites running vulnerable versions of the WPLMS plugin. Attackers can achieve remote code execution and full server compromise. All WordPress installations with WPLMS versions before 1.9.9.5.2 are affected.
💻 Affected Systems
- VibeThemes WPLMS WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with data exfiltration, ransomware deployment, and persistent backdoor installation across the entire hosting environment.
Likely Case
Web shell upload leading to website defacement, credential theft, and lateral movement within the hosting infrastructure.
If Mitigated
File upload attempts blocked at web application firewall level with no successful exploitation.
🎯 Exploit Status
Exploitation requires no authentication and uses simple HTTP POST requests with file uploads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.9.5.2
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WPLMS plugin. 4. Click 'Update Now' if update available. 5. If no update appears, manually download version 1.9.9.5.2+ from WordPress repository. 6. Deactivate old plugin. 7. Upload new version via FTP or WordPress uploader. 8. Activate updated plugin.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock file uploads to vulnerable WPLMS endpoints
# Example ModSecurity rule: SecRule REQUEST_URI "@rx /wp-content/plugins/wplms/.*upload" "id:1001,phase:2,deny,status:403,msg:'Block WPLMS file upload attempt'"
File System Permissions Restriction
linuxRemove write permissions from WPLMS upload directories
chmod -R 755 /var/www/html/wp-content/plugins/wplms/
chown -R www-data:www-data /var/www/html/wp-content/plugins/wplms/
🧯 If You Can't Patch
- Immediately disable or remove the WPLMS plugin from all WordPress installations
- Implement strict file upload filtering at the web server level (Apache/Nginx) to block PHP and executable file uploads
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → WPLMS version number. If version is below 1.9.9.5.2, system is vulnerable.Check Version:
wp plugin list --name=wplms --field=versionVerify Fix Applied:
Confirm WPLMS plugin version is 1.9.9.5.2 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /wp-content/plugins/wplms/*upload* endpoints
- File uploads with .php, .phtml, .phar extensions in WPLMS directories
- Unusual file creation in wp-content/uploads/wplms/ directories
Network Indicators:
- POST requests with multipart/form-data to WPLMS endpoints
- Unusual outbound connections from web server following file uploads
SIEM Query:
source="web_server" AND (uri_path="/wp-content/plugins/wplms/" AND http_method="POST" AND content_type="multipart/form-data")