CVE-2024-56054
📋 TL;DR
This vulnerability allows attackers to upload arbitrary files, including web shells, to WordPress sites using the WPLMS plugin. It affects all WordPress installations with vulnerable versions of the WPLMS plugin, potentially giving attackers full control over affected websites.
💻 Affected Systems
- WordPress WPLMS Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the WordPress site, data theft, defacement, and use as a pivot point for attacking other systems.
Likely Case
Attackers upload web shells to gain persistent access, install malware, or steal sensitive data from the site.
If Mitigated
If proper file upload restrictions and web application firewalls are in place, exploitation attempts would be blocked.
🎯 Exploit Status
Exploitation requires instructor-level access in WPLMS, making it authenticated but not requiring admin privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.9.5.2
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WPLMS and click 'Update Now' if available. 4. Alternatively, download version 1.9.9.5.2 from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable File Uploads for Instructors
allTemporarily restrict file upload capabilities for instructor roles in WPLMS settings.
Web Application Firewall Rule
allBlock uploads of executable file types (.php, .asp, .jsp, etc.) at the WAF level.
🧯 If You Can't Patch
- Disable the WPLMS plugin entirely until patching is possible.
- Implement strict file upload validation at the server level using .htaccess or nginx rules.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for WPLMS version. If version is below 1.9.9.5.2, the site is vulnerable.Check Version:
wp plugin list --name=wplms --field=versionVerify Fix Applied:
After updating, confirm WPLMS version shows as 1.9.9.5.2 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to WPLMS directories, especially .php files from instructor accounts.
- Web server logs showing POST requests to upload endpoints with suspicious file extensions.
Network Indicators:
- HTTP POST requests to /wp-content/uploads/wplms/ or similar paths with executable file uploads.
SIEM Query:
source="web_server" AND method="POST" AND uri="/wp-content/uploads/wplms/" AND (extension=".php" OR extension=".asp" OR extension=".jsp")