Critical Unauthenticated RCE in WordPress File Upload Plugin (CVE-2024-9047)

CVE-2024-9047 is a critical security vulnerability affecting the Iptanus WordPress File Upload plugin in versions 4.24.11 and earlier. The vulnerability exists within the wfu_file_downloader.php file, which fails to properly sanitize user-supplied input. An unauthenticated attacker can leverage path traversal techniques to bypass security controls and perform arbitrary file access, manipulation, or modification on the host server. Given the availability of public proof-of-concept exploits and a high EPSS score of 93.3%, this vulnerability poses an immediate risk to WordPress instances running the affected software. Successful exploitation can lead to unauthenticated remote code execution, granting the attacker full control over the compromised web server and its hosted content.

Attack Chain

1. The attacker performs reconnaissance on a target WordPress site to confirm the presence of the 'wp-file-upload' plugin.
2. The attacker identifies the vulnerable 'wfu_file_downloader.php' script located in '/wp-content/plugins/wp-file-upload/'.
3. The attacker crafts a malicious HTTP GET request targeting the 'wfu_file_downloader.php' script.
4. The attacker injects path traversal payloads into the 'file' query parameter to escape the intended directory scope.
5. The server processes the malicious input, allowing the attacker to access or include arbitrary files on the system.
6. The attacker leverages the ability to include or manipulate files to execute arbitrary PHP code on the server.
7. Upon successful execution, the attacker gains a remote code execution context, allowing for further payload delivery or system compromise.

Impact

Successful exploitation of CVE-2024-9047 results in complete compromise of the WordPress site. Attackers can read sensitive configuration files, modify core site files, or inject webshells to maintain persistent access. With a CVSS score of 9.8, the potential for data exfiltration, service disruption, and unauthorized administrative control is severe.

Recommendation

• Immediately update the WordPress File Upload plugin to version 4.24.12 or later to mitigate CVE-2024-9047.
• Implement the following web server log detection rule to identify exploitation attempts targeting the vulnerable file.
• Audit access logs for anomalous HTTP GET requests involving the 'wfu_file_downloader.php' script containing path traversal characters like '../'.