CVE-2024-5852
📋 TL;DR
The WordPress File Upload plugin contains a directory traversal vulnerability that allows authenticated attackers with Contributor-level access or higher to upload limited files to arbitrary locations on the web server. This affects all versions up to and including 4.24.7. Attackers can potentially place malicious files in unintended directories.
💻 Affected Systems
- WordPress File Upload plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could upload web shells or malicious scripts to sensitive directories, potentially leading to remote code execution, data theft, or complete site compromise.
Likely Case
Attackers upload malicious files to accessible directories, potentially defacing websites, distributing malware, or establishing persistence for further attacks.
If Mitigated
With proper file type restrictions and directory permissions, impact is limited to uploading allowed file types to unintended locations.
🎯 Exploit Status
Exploitation requires authenticated access with at least Contributor privileges. The vulnerability is in the 'uploadpath' parameter of the wordpress_file_upload shortcode.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.24.8 and later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3118456%40wp-file-upload&new=3118456%40wp-file-upload
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'WordPress File Upload' plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 4.24.8+ from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable shortcode
allRemove or disable the wordpress_file_upload shortcode from posts/pages
Restrict user roles
allTemporarily remove Contributor role access or limit who can create/edit posts
🧯 If You Can't Patch
- Implement strict file upload restrictions in web server configuration
- Monitor file upload directories for unexpected files and implement file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for WordPress File Upload version. If version is 4.24.7 or lower, you are vulnerable.Check Version:
wp plugin list --name='wordpress-file-upload' --field=versionVerify Fix Applied:
After updating, verify plugin version shows 4.24.8 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to non-standard directories
- Multiple failed upload attempts with directory traversal patterns
Network Indicators:
- POST requests to upload endpoints with 'uploadpath' parameter containing '../' sequences
SIEM Query:
source="wordpress.log" AND "uploadpath" AND ("../" OR "..\")🔗 References
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3118456%40wp-file-upload&new=3118456%40wp-file-upload&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/39bb69e0-fb18-4737-9eb7-bda2b5bc16a2?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3118456%40wp-file-upload&new=3118456%40wp-file-upload&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/39bb69e0-fb18-4737-9eb7-bda2b5bc16a2?source=cve
