CVE-2024-7484
📋 TL;DR
The CRM Perks Forms WordPress plugin allows authenticated administrators to upload arbitrary files due to insufficient validation in the 'handle_uploaded_files' function. This vulnerability can lead to remote code execution on affected WordPress sites. Only WordPress installations using CRM Perks Forms versions 1.1.3 and earlier are affected.
💻 Affected Systems
- CRM Perks Forms WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise via remote code execution, allowing attackers to install backdoors, steal data, or pivot to other systems.
Likely Case
Website defacement, malware injection, or data theft through uploaded web shells.
If Mitigated
Limited impact if file uploads are restricted at web server level or administrator accounts are properly secured.
🎯 Exploit Status
Exploitation requires administrator credentials. Public proof-of-concept code is available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.4
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3016768/crm-perks-forms
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find CRM Perks Forms and click 'Update Now'. 4. Verify version is 1.1.4 or higher.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the CRM Perks Forms plugin until patched.
wp plugin deactivate crm-perks-forms
Restrict File Uploads
linuxConfigure web server to block PHP file uploads in plugin directories.
<FilesMatch "\.(php|php3|php4|php5|phtml|pl|py|jsp|asp|sh|cgi)$">
Order Allow,Deny
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Remove administrator access from untrusted users and enforce strong password policies.
- Implement web application firewall rules to block suspicious file upload patterns.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for CRM Perks Forms version 1.1.3 or lower.Check Version:
wp plugin get crm-perks-forms --field=versionVerify Fix Applied:
Confirm CRM Perks Forms version is 1.1.4 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /wp-content/plugins/crm-perks-forms/
- POST requests to front-form.php with file upload parameters
Network Indicators:
- HTTP POST requests with file uploads to CRM Perks Forms endpoints
SIEM Query:
source="web_logs" AND uri="*front-form.php*" AND method="POST" AND (file_upload="true" OR contains("multipart/form-data"))