CVE-2022-24663: PHP Everywhere RCE Vulnerability

CVE-2022-24663 Overview

CVE-2022-24663 is a code injection vulnerability in the PHP Everywhere WordPress plugin that allows any authenticated user to execute arbitrary PHP code via WordPress shortcodes. The vulnerability exists in PHP Everywhere versions 2.0.3 and earlier, where improper access controls enable low-privileged users (including subscribers) to leverage the plugin's shortcode functionality to run malicious PHP code on the server.

Critical Impact

Authenticated attackers with minimal privileges (subscriber-level) can achieve full remote code execution on vulnerable WordPress installations, potentially leading to complete site takeover, data theft, or server compromise.

Affected Products

• PHP Everywhere plugin for WordPress versions <= 2.0.3
• WordPress installations with PHP Everywhere plugin enabled
• php_everywhere_project php_everywhere

Discovery Timeline

• 2022-02-16 - CVE-2022-24663 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-24663

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The PHP Everywhere plugin was designed to allow site administrators to embed PHP code within WordPress posts and pages using shortcodes. However, the implementation failed to properly restrict which user roles could execute these shortcodes.

The vulnerability allows any authenticated user, regardless of their privilege level, to craft malicious shortcodes that execute arbitrary PHP code on the server. This represents a complete breakdown of the intended security model, where only administrators should have been able to execute PHP code.

The network-accessible nature of this vulnerability, combined with the low barrier to exploitation (only requiring basic authentication), makes it particularly dangerous for WordPress sites that allow user registration.

Root Cause

The root cause of this vulnerability lies in insufficient authorization checks within the PHP Everywhere plugin's shortcode processing functionality. The plugin failed to verify that the user initiating a PHP code execution request possessed the appropriate administrative privileges. Instead, any authenticated user—including those with the lowest privilege level (subscriber)—could invoke the shortcode functionality to execute arbitrary PHP code.

Attack Vector

The attack vector for CVE-2022-24663 is network-based and requires only low-privilege authentication. An attacker can exploit this vulnerability through the following attack chain:

1. Create or obtain a subscriber-level account on the target WordPress installation
2. Craft a malicious WordPress shortcode that invokes the PHP Everywhere functionality
3. Embed arbitrary PHP code within the shortcode parameters
4. Submit the payload through a post, comment, or other user-accessible content area
5. The server processes the shortcode and executes the attacker's PHP code with web server privileges

The vulnerability allows attackers to perform various malicious actions including reading sensitive configuration files (such as wp-config.php), creating backdoor accounts, installing web shells, pivoting to other systems, or completely taking over the WordPress installation.

Detection Methods for CVE-2022-24663

Indicators of Compromise

• Unexpected PHP code execution logs in web server access logs
• New administrator accounts created without authorization
• Suspicious shortcode content in posts, comments, or user-submitted content
• Web shell files appearing in the WordPress directory structure
• Unusual outbound network connections from the web server

Detection Strategies

• Monitor WordPress database for suspicious shortcode patterns containing PHP code
• Review web server logs for POST requests with PHP code snippets in parameters
• Implement file integrity monitoring on WordPress core and plugin directories
• Audit user activity logs for subscriber accounts creating or editing posts with shortcodes

Monitoring Recommendations

• Enable comprehensive logging for all WordPress user actions
• Deploy web application firewalls (WAF) with rules to detect PHP code in user-submitted content
• Implement real-time alerting for new file creation in WordPress directories
• Monitor for privilege escalation attempts and unauthorized account creation

How to Mitigate CVE-2022-24663

Immediate Actions Required

• Update PHP Everywhere plugin to version 3.0.0 or later immediately
• Audit all subscriber and contributor accounts for suspicious activity
• Review recently created or modified posts and pages for malicious shortcodes
• Consider temporarily disabling the PHP Everywhere plugin until patching is complete
• Check for unauthorized administrator accounts and web shell files

Patch Information

The vulnerability has been addressed in PHP Everywhere version 3.0.0, which implements proper role-based access controls for PHP code execution functionality. Organizations should update to the latest version of the plugin through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository.

For detailed information about this vulnerability and the patch, refer to the Wordfence Blog on PHP Vulnerabilities.

Workarounds

• Disable the PHP Everywhere plugin entirely if it is not critical to site functionality
• Restrict user registration on WordPress sites to prevent attackers from obtaining authenticated access
• Implement strict content security policies to limit shortcode processing
• Use a web application firewall to block requests containing PHP code patterns in user-controllable fields
• Remove or disable subscriber and contributor role capabilities for creating or editing posts