WordPress File Upload Plugin Unauth File Read & RCE Analysis (CVE-2024-9939/CVE-2024-11635)

Vulnerability Overview This article details two critical security vulnerabilities in the WordPress File Upload plugin: 1. CVE-2024-9939 (CVSS 7.5): An unauthenticated arbitrary file read vulnerability. Attackers can bypass the authentication check in (which only verifies if the Cookie has expired) to read arbitrary files on the server. 2. CVE-2024-11635 (CVSS 9.8): An unauthenticated Remote Code Execution (RCE) vulnerability. When the Cookie is missing or expired, the system invokes the function. This function directly uses the value of the Cookie within a statement without any sanitization or validation. Attackers can exploit this point combined with a attack vector to achieve Remote File Inclusion (RFI) or Local File Inclusion (LFI), thereby executing arbitrary code. Scope of Impact Plugin Name: WordPress File Upload Affected Versions: ≤ 4.24.12 Remediation The vendor has remediated these vulnerabilities by completely eliminating the use of inputs via Cookies. Key Code Snippets (POC/Analysis) 1. Core Logic of (CVE-2024-9939 Analysis)** This file contains the function, which has a flawed authentication logic that only checks if the Cookie has expired, making it easily bypassable. ```php //wp-file-upload-4.24.12/wfu_file_downloader.php <?php if ( defined('ABWPFILEUPLOAD_DIR') ) define('ABWPFILEUPLOAD_DIR', dirname( if ( defined('WFU_AUTOLOADER_PHP5688') ) define('WFU_AUTOLOADER_PHP5688', include_once ABWPFILEUPLOAD_DIR . '/lib/wfu_functions.php' ); $handler = (isset($_POST['handler'])) ? $_POST['handler'] : (isset($_GET['handler']) ? $_GET['handler'] : 'session_legacy'); $session_legacy = (isset($_POST['session_legacy'])) ? $_POST['session_legacy'] : (isset($_GET['session_legacy']) ? $_GET['session_legacy'] : ''); $doption_useold = (isset($_POST['doption_useold'])) ? $_POST['doption_useold'] : (isset($_GET['doption_useold']) ? $_GET['doption_useold'] : ''); $wfu_cookie = (isset($_POST['wfu_cookie'])) ? $_POST['wfu_cookie'] : (isset($_GET['wfu_cookie']) ? $_GET['wfu_cookie'] : ''); if ( $handler == '1' ) $session_legacy = '1'; if ( $doption_useold == '1' ) $doption_base = '1'; else {

Goal Reached Thanks to every supporter — we hit 100%!

WordPress File Upload Plugin Unauth File Read & RCE Analysis (CVE-2024-9939/CVE-2024-11635)