CVE-2024-8671
📋 TL;DR
The WooEvents WordPress plugin has a critical vulnerability that allows unauthenticated attackers to overwrite arbitrary files on the server due to insufficient path validation. This can lead to remote code execution by overwriting critical files like wp-config.php. All WordPress sites using WooEvents plugin versions up to 4.1.2 are affected.
💻 Affected Systems
- WooEvents - Calendar and Event Booking plugin for WordPress
📦 What is this software?
Wooevents by Exthemes
⚠️ Risk & Real-World Impact
Worst Case
Complete site compromise via remote code execution, data theft, defacement, or malware installation
Likely Case
Website defacement, data manipulation, or backdoor installation leading to persistent access
If Mitigated
Limited impact if file permissions restrict write access to critical system files
🎯 Exploit Status
Exploitation is straightforward with publicly available details
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.3 or later
Vendor Advisory: https://codecanyon.net/item/wooevents-calendar-and-event-booking/15598178
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find WooEvents plugin
4. Click 'Update Now' if available
5. If no update available, deactivate and remove plugin immediately
🔧 Temporary Workarounds
Disable WooEvents plugin
allTemporarily deactivate the vulnerable plugin until patched
wp plugin deactivate wooevents
Restrict file permissions
linuxSet restrictive permissions on wp-config.php and other critical files
chmod 400 wp-config.php
chown root:root wp-config.php
🧯 If You Can't Patch
- Immediately deactivate and remove the WooEvents plugin
- Implement web application firewall rules to block requests to inc/barcode.php
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → WooEvents version numberCheck Version:
wp plugin get wooevents --field=versionVerify Fix Applied:
Verify WooEvents plugin version is 4.1.3 or higher📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /wp-content/plugins/wooevents/inc/barcode.php with unusual parameters
- File modification events on wp-config.php or other critical files
Network Indicators:
- POST requests to barcode.php endpoint with file path parameters
SIEM Query:
source="web_server" AND uri="*barcode.php*" AND (param="*../*" OR param="*wp-config*")