WordPress Remote Code Execution Vulnerability (CVE-2024-31210) — High Severity

A significant security flaw has been discovered in WordPress, the popular web publishing platform. This vulnerability, identified as CVE-2024-31210, allows an administrative user to bypass certain file upload restrictions, potentially leading to remote code execution (RCE) under specific conditions. While it requires a high level of user privilege and particular server configurations, its potential impact categorizes it as a high-severity risk.

CVE Details

Product: WordPress
Published: April 4, 2024
Severity: High
Status: Analyzed

Affected Products

This vulnerability affects numerous versions of WordPress. Users running any of the following versions should take immediate action:

• WordPress versions from 6.4.0 up to, but not including, 6.4.3
• WordPress versions from 6.3.0 up to, but not including, 6.3.3
• WordPress versions from 6.2.0 up to, but not including, 6.2.4
• WordPress versions from 6.1.0 up to, but not including, 6.1.5
• WordPress versions from 6.0.0 up to, but not including, 6.0.7
• WordPress versions from 5.9.0 up to, but not including, 5.9.9
• WordPress versions from 5.8.0 up to, but not including, 5.8.9
• WordPress versions from 5.7.0 up to, but not including, 5.7.11
• WordPress versions from 5.6.0 up to, but not including, 5.6.13
• WordPress versions from 5.5.0 up to, but not including, 5.5.14
• WordPress versions from 5.4.0 up to, but not including, 5.4.15
• WordPress versions from 5.3.0 up to, but not including, 5.3.17
• WordPress versions from 5.2.0 up to, but not including, 5.2.20
• WordPress versions from 5.1.0 up to, but not including, 5.1.18
• WordPress versions from 5.0.0 up to, but not including, 5.0.21
• WordPress versions from 4.9.0 up to, but not including, 4.9.25
• WordPress versions from 4.8.0 up to, but not including, 4.8.24
• WordPress versions from 4.7.0 up to, but not including, 4.7.28
• WordPress versions from 4.6.0 up to, but not including, 4.6.28
• WordPress versions from 4.5.0 up to, but not including, 4.5.31
• WordPress versions from 4.4.0 up to, but not including, 4.4.32
• WordPress versions from 4.3.0 up to, but not including, 4.3.33
• WordPress versions from 4.2.0 up to, but not including, 4.2.37
• WordPress versions prior to 4.1.40

Current Status

The vulnerability has been thoroughly analyzed.

Severity Level

This vulnerability is rated as High severity with a CVSS score of 7.7 out of 10. While it can lead to remote code execution, certain conditions must be met for exploitation. Specifically, an administrative user needs to upload a non-zip file as a plugin. If FTP credentials are required for file installation outside the uploads directory, and the DISALLOW_FILE_EDIT constant is set to true, the uploaded file remains temporarily in the Media Library. This scenario then opens a path for RCE for the administrative user, who might otherwise be prevented from executing arbitrary PHP code.

Possible Solutions

The good news is that fixes are available. It is strongly recommended to update your WordPress installation immediately.

• Update to the latest patched versions:
  • WordPress 6.4.3
  • WordPress 6.3.3
  • WordPress 6.2.4
  • WordPress 6.1.5
  • WordPress 6.0.7
  • WordPress 5.9.9
  • WordPress 5.8.9
  • WordPress 5.7.11
  • WordPress 5.6.13
  • WordPress 5.5.14
  • WordPress 5.4.15
  • WordPress 5.3.17
  • WordPress 5.2.20
  • WordPress 5.1.18
  • WordPress 5.0.21
  • WordPress 4.9.25
  • WordPress 4.8.24
  • WordPress 4.7.28
  • WordPress 4.6.28
  • WordPress 4.5.31
  • WordPress 4.4.32
  • WordPress 4.3.33
  • WordPress 4.2.37
  • WordPress 4.1.40
• Workaround: If immediate updating is not possible, you can implement a mitigation by adding the following line to your wp-config.php file:

  define( 'DISALLOW_FILE_MODS', true );

  This setting will prevent any user from uploading plugins, thereby eliminating the exploit vector for this specific vulnerability.

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r