{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/acf-city-selector--1.14.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wordpress:acf_city_selector:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.6,"id":"CVE-2024-56264"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ACF City Selector (\u003c= 1.14.0)"],"_cs_severities":["low"],"_cs_tags":["wordpress","web-shell","rce","file-upload"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eCVE-2024-56264 is an arbitrary file upload vulnerability affecting the WordPress ACF City Selector plugin in versions 1.14.0 and earlier. The flaw resides in the plugin's insufficient file validation mechanisms, which allow an authenticated user with administrative privileges to upload arbitrary files, including PHP web shells, to the server. By successfully uploading a PHP script to the plugin's designated upload directory, an attacker can gain remote code execution capabilities. Because this vulnerability requires high privileges (authentication), it is primarily a risk for organizations that allow broad administrative access to their WordPress backends or are targets of account takeover campaigns. Defenders should prioritize auditing the permissions of users capable of modifying plugin settings and monitor for unauthorized files appearing within the expected upload paths.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the target WordPress instance as an administrator.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the ACF City Selector plugin settings interface.\u003c/li\u003e\n\u003cli\u003eAttacker initiates an upload request targeting the plugin's file handling functionality.\u003c/li\u003e\n\u003cli\u003eAttacker submits a request containing a crafted malicious PHP file.\u003c/li\u003e\n\u003cli\u003eThe plugin fails to validate the file extension or content, allowing the PHP file to be saved to the server.\u003c/li\u003e\n\u003cli\u003eThe file is written to the 'wp-content/uploads/acfcs/' directory.\u003c/li\u003e\n\u003cli\u003eAttacker accesses the uploaded file via a direct HTTP GET request to trigger execution.\u003c/li\u003e\n\u003cli\u003eAttacker executes arbitrary system commands via the web shell, leading to server compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote code execution on the web server. This provides the attacker the ability to maintain persistence, exfiltrate sensitive site data, modify content, or pivot into the underlying host environment. The impact is limited to the web server context but can lead to a total loss of confidentiality, integrity, and availability for the compromised WordPress application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect suspicious HTTP POST requests associated with web shell creation patterns in this specific path.\u003c/li\u003e\n\u003cli\u003eAudit all files currently residing in 'wp-content/uploads/acfcs/' for unauthorized or suspicious PHP scripts.\u003c/li\u003e\n\u003cli\u003eEnforce strict administrative access controls and review active user accounts for anomalous login patterns to mitigate the high-privilege requirement.\u003c/li\u003e\n\u003cli\u003ePatch or update the ACF City Selector plugin to a version addressing this vulnerability if available.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T09:06:00Z","date_published":"2026-10-20T09:06:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-56264/","summary":"An arbitrary file upload vulnerability in the WordPress ACF City Selector plugin (\u003c= 1.14.0) allows an authenticated administrator to achieve remote code execution by uploading a malicious PHP shell.","title":"ACF City Selector: Arbitrary file upload remote code execution (CVE-2024-56264)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-56264/"}],"language":"en","title":"CraftedSignal Threat Feed - ACF City Selector (\u003c= 1.14.0)","version":"https://jsonfeed.org/version/1.1"}