Cpe:2.3:a:wordpress:acf_city_selector:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awordpressacf_city_selector/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 20 Oct 2026 09:06:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgACF City Selector: Arbitrary file upload remote code execution (CVE-2024-56264)https://feed.craftedsignal.io/briefs/2026-10-cve-2024-56264/Tue, 20 Oct 2026 09:06:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2024-56264/An arbitrary file upload vulnerability in the WordPress ACF City Selector plugin (<= 1.14.0) allows an authenticated administrator to achieve remote code execution by uploading a malicious PHP shell.CVE-2024-56264 is an arbitrary file upload vulnerability affecting the WordPress ACF City Selector plugin in versions 1.14.0 and earlier. The flaw resides in the plugin's insufficient file validation mechanisms, which allow an authenticated user with administrative privileges to upload arbitrary files, including PHP web shells, to the server. By successfully uploading a PHP script to the plugin's designated upload directory, an attacker can gain remote code execution capabilities. Because this vulnerability requires high privileges (authentication), it is primarily a risk for organizations that allow broad administrative access to their WordPress backends or are targets of account takeover campaigns. Defenders should prioritize auditing the permissions of users capable of modifying plugin settings and monitor for unauthorized files appearing within the expected upload paths.

Attack Chain

  1. Attacker authenticates to the target WordPress instance as an administrator.
  2. Attacker navigates to the ACF City Selector plugin settings interface.
  3. Attacker initiates an upload request targeting the plugin's file handling functionality.
  4. Attacker submits a request containing a crafted malicious PHP file.
  5. The plugin fails to validate the file extension or content, allowing the PHP file to be saved to the server.
  6. The file is written to the 'wp-content/uploads/acfcs/' directory.
  7. Attacker accesses the uploaded file via a direct HTTP GET request to trigger execution.
  8. Attacker executes arbitrary system commands via the web shell, leading to server compromise.

Impact

Successful exploitation results in full remote code execution on the web server. This provides the attacker the ability to maintain persistence, exfiltrate sensitive site data, modify content, or pivot into the underlying host environment. The impact is limited to the web server context but can lead to a total loss of confidentiality, integrity, and availability for the compromised WordPress application.

Recommendation

  • Deploy the provided Sigma rule to detect suspicious HTTP POST requests associated with web shell creation patterns in this specific path.
  • Audit all files currently residing in 'wp-content/uploads/acfcs/' for unauthorized or suspicious PHP scripts.
  • Enforce strict administrative access controls and review active user accounts for anomalous login patterns to mitigate the high-privilege requirement.
  • Patch or update the ACF City Selector plugin to a version addressing this vulnerability if available.
]]>lowadvisorywordpressweb-shellrcefile-upload