Automatic Translation WordPress Plugin: Unauthenticated Remote Code Execution (CVE-2024-50493)

The Automatic Translation WordPress plugin is vulnerable to an unauthenticated arbitrary file upload flaw due to the lack of file type validation in versions 1.0.4 and earlier. The vulnerability resides in the /wp-json/automatic-translator/v1/saveDoc API endpoint. An attacker can use this flaw to upload arbitrary files, such as PHP web shells, to the web server, leading to potential remote code execution. A functional exploit proof-of-concept (PoC) has been publicly released.

Impact

Successful exploitation allows an unauthenticated, remote attacker to execute arbitrary code on the target web server with the privileges of the web application service. This can lead to full server compromise, data exfiltration, and lateral movement within the hosting environment.

Recommendation

• Identify and audit all WordPress installations for the presence of the 'Automatic Translation' plugin.
• Update the 'Automatic Translation' plugin to a version beyond 1.0.4 immediately. If an update is unavailable, disable or remove the plugin until a patch is applied.
• Implement web application firewall (WAF) rules to block POST requests directed at /wp-json/automatic-translator/v1/saveDoc.
• Monitor server file systems for the creation of new or unknown files within the plugin directory or web root, particularly PHP files.