TI-2024-20587 Aliases CVE-2024-31210

PHP file upload bypass via Plugin installer

MEDIUM 42CWE-434Published 2024-04-04 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials are requested for installation (in order to move the file into place outside of the `uploads` directory) then the uploaded file remains temporary available in the Media Library despite it not being allowed. If the `DISALLOW_FILE_EDIT` constant is set to `true` on the site _and_ FTP credentials are required when uploading a new theme or plugin, then this technically allows an RCE when the user would otherwise have no means of executing arbitrary PHP code. This issue _only_ affects Administrator level users on single site installations, and Super Admin level users on Multisite installations where it's otherwise expected that the user does not have permission to upload or execute arbitrary PHP code. Lower level users are not affected. Sites where the `DISALLOW_FILE_MODS` constant is set to `true` are not affected. Sites where an administrative user either does not need to enter FTP credentials or they have access to the valid FTP credentials, are not affected. The issue was fixed in WordPress 6.4.3 on January 30, 2024 and backported to versions 6.3.3, 6.2.4, 6.1.5, 6.0.7, 5.9.9, 5.8.9, 5.7.11, 5.6.13, 5.5.14, 5.4.15, 5.3.17, 5.2.20, 5.1.18, 5.0.21, 4.9.25, 2.8.24, 4.7.28, 4.6.28, 4.5.31, 4.4.32, 4.3.33, 4.2.37, and 4.1.40. A workaround is available. If the `DISALLOW_FILE_MODS` constant is defined as `true` then it will not be possible for any user to upload a plugin and therefore this issue will not be exploitable.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00995 62nd percentileScored 2026-11-07

Fix Fixed wordpress-develop (WordPress): 6.4.3, 6.3.3, 6.2.4 +21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WordPress	wordpress-develop	6.4.0 to before 6.4.3; 6.3.0 to before 6.3.3; 6.2.0 to before 6.2.4; 6.1.0 to before 6.1.5; 6.0.0 to before 6.0.7; 5.9.0 to before 5.9.9; 5.8.0 to before 5.8.9; 5.7.0 to before 5.7.11; 5.6.0 to before 5.6.13; 5.5.0 to before 5.5.14; 5.4.0 to before 5.4.15; 5.3.0 to before 5.3.17; 5.2.0 to before 5.2.20; 5.1.0 to before 5.1.18; 5.0.0 to before 5.0.21; 4.9.0 to before 4.9.25; 4.8.0 to before 4.8.24; 4.7.0 to before 4.7.28; 4.6.0 to before 4.6.28; 4.5.0 to before 4.5.31; 4.4.0 to before 4.4.32; 4.3.0 to before 4.3.33; 4.2.0 to before 4.2.37; before 4.1.40	6.4.3, 6.3.3, 6.2.4, 6.1.5, 6.0.7, 5.9.9, 5.8.9, 5.7.11, 5.6.13, 5.5.14, 5.4.15, 5.3.17, 5.2.20, 5.1.18, 5.0.21, 4.9.25, 4.8.24, 4.7.28, 4.6.28, 4.5.31, 4.4.32, 4.3.33, 4.2.37, 4.1.40	Patch available	CNA

wordpress-develop VendorWordPress Affected 6.4.0 to before 6.4.3; 6.3.0 to before 6.3.3; 6.2.0 to before 6.2.4; 6.1.0 to before 6.1.5; 6.0.0 to before 6.0.7; 5.9.0 to before 5.9.9; 5.8.0 to before 5.8.9; 5.7.0 to before 5.7.11; 5.6.0 to before 5.6.13; 5.5.0 to before 5.5.14; 5.4.0 to before 5.4.15; 5.3.0 to before 5.3.17; 5.2.0 to before 5.2.20; 5.1.0 to before 5.1.18; 5.0.0 to before 5.0.21; 4.9.0 to before 4.9.25; 4.8.0 to before 4.8.24; 4.7.0 to before 4.7.28; 4.6.0 to before 4.6.28; 4.5.0 to before 4.5.31; 4.4.0 to before 4.4.32; 4.3.0 to before 4.3.33; 4.2.0 to before 4.2.37; before 4.1.40 Fixed in 6.4.3, 6.3.3, 6.2.4, 6.1.5, 6.0.7, 5.9.9, 5.8.9, 5.7.11, 5.6.13, 5.5.14, 5.4.15, 5.3.17, 5.2.20, 5.1.18, 5.0.21, 4.9.25, 4.8.24, 4.7.28, 4.6.28, 4.5.31, 4.4.32, 4.3.33, 4.2.37, 4.1.40 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wordpress:wordpress::::::::	before 4.1.40; 4.2 to before 4.2.37; 4.3 to before 4.3.33; 4.4 to before 4.4.32; 4.5 to before 4.5.31; 4.6 to before 4.6.28; 4.7 to before 4.7.28; 4.8 to before 4.8.24; 4.9 to before 4.9.25; 5.0 to before 5.0.21; 5.1 to before 5.1.18; 5.2 to before 5.2.20; 5.3 to before 5.3.17; 5.4 to before 5.4.15; 5.5 to before 5.5.14; 5.6 to before 5.6.13; 5.7 to before 5.7.11; 5.8 to before 5.8.9; 5.9 to before 5.9.9; 6.0 to before 6.0.7; 6.1 to before 6.1.5; 6.2 to before 6.2.4; 6.3 to before 6.3.3; 6.4.0 to before 6.4.3	Vulnerable	WordPress

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* Versions before 4.1.40; 4.2 to before 4.2.37; 4.3 to before 4.3.33; 4.4 to before 4.4.32; 4.5 to before 4.5.31; 4.6 to before 4.6.28; 4.7 to before 4.7.28; 4.8 to before 4.8.24; 4.9 to before 4.9.25; 5.0 to before 5.0.21; 5.1 to before 5.1.18; 5.2 to before 5.2.20; 5.3 to before 5.3.17; 5.4 to before 5.4.15; 5.5 to before 5.5.14; 5.6 to before 5.6.13; 5.7 to before 5.7.11; 5.8 to before 5.8.9; 5.9 to before 5.9.9; 6.0 to before 6.0.7; 6.1 to before 6.1.5; 6.2 to before 6.2.4; 6.3 to before 6.3.3; 6.4.0 to before 6.4.3 Vulnerable ·WordPress

Remediation

Fix · CNA wordpress-develop (WordPress) Fixed in 6.4.3, 6.3.3, 6.2.4, 6.1.5, 6.0.7, 5.9.9, 5.8.9, 5.7.11, 5.6.13, 5.5.14, 5.4.15, 5.3.17, 5.2.20, 5.1.18, 5.0.21, 4.9.25, 4.8.24, 4.7.28, 4.6.28, 4.5.31, 4.4.32, 4.3.33, 4.2.37, 4.1.40

Timeline

2026-10-02 Threatist record created from CVE-2024-31210

References

Advisory 1

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r

TI-2026-45010 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution KEVCVSS 3.1CRITICAL 9.8
TI-2016-08118 The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow… KEVCVSS 3.1CRITICAL 9.8
TI-2026-83466 Predictable staging paths let attackers run code in WordPress Core KEVCVSS 3.1HIGH 8.1
TI-2026-59973 An unauthenticated attacker can make `get_page_template()` page-template resolution… KEVCVSS 3.1HIGH 8.1
TI-2016-08129 The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass… CVSS 3.1CRITICAL 9.8
TI-2026-42844 WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query KEVCVSS 3.1MEDIUM 5.9

See all 356 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences