CVE-2024-5709
📋 TL;DR
The WPBakery Visual Composer plugin for WordPress has a Local File Inclusion vulnerability that allows authenticated attackers with Author-level permissions to include and execute arbitrary PHP files on the server. This can lead to remote code execution, data theft, and privilege escalation. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- WPBakery Visual Composer WordPress Plugin
📦 What is this software?
Page Builder by Wpbakery
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data exfiltration, ransomware deployment, or persistent backdoor installation.
Likely Case
Unauthorized code execution leading to website defacement, credential theft, or installation of malware.
If Mitigated
Limited impact if proper file upload restrictions and server hardening are in place.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.8 or later
Vendor Advisory: https://wpbakery.com/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WPBakery Visual Composer. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from wpbakery.com and manually update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable WPBakery Visual Composer plugin until patched.
wp plugin deactivate js_composer
Restrict File Uploads
linuxConfigure web server to block PHP file execution in upload directories.
Add 'php_flag engine off' to .htaccess in upload directories
🧯 If You Can't Patch
- Remove Author-level user accounts or restrict their post permissions
- Implement web application firewall rules to block requests containing 'layout_name' parameter manipulation
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins > Installed Plugins. If version is 7.7 or lower, you are vulnerable.Check Version:
wp plugin get js_composer --field=versionVerify Fix Applied:
Verify plugin version is 7.8 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual file inclusion attempts in web server logs
- POST requests to wp-admin/admin-ajax.php with layout_name parameter containing path traversal sequences
Network Indicators:
- HTTP requests with suspicious layout_name parameter values
- Unexpected PHP file execution from upload directories
SIEM Query:
source="web_server_logs" AND (layout_name CONTAINS "../" OR layout_name CONTAINS "/etc/" OR layout_name CONTAINS "/proc/")