CVE-2024-10392: AI Power WordPress Plugin RCE Vulnerability

CVE-2024-10392 Overview

The AI Power: Complete AI Pack plugin for WordPress contains a critical arbitrary file upload vulnerability in the handle_image_upload function. Due to missing file type validation, unauthenticated attackers can upload arbitrary files to the affected site's server, potentially leading to remote code execution. This vulnerability affects all versions of the plugin up to and including version 1.8.89.

Critical Impact

Unauthenticated attackers can upload malicious files to WordPress servers, enabling remote code execution and complete site compromise without requiring any authentication credentials.

Affected Products

• AI Power: Complete AI Pack plugin for WordPress versions up to and including 1.8.89
• WordPress sites with the vulnerable plugin installed
• Any hosting environment running affected plugin versions

Discovery Timeline

• 2024-10-31 - CVE-2024-10392 published to NVD
• 2024-11-01 - Last updated in NVD database

Technical Details for CVE-2024-10392

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The core issue resides in the handle_image_upload function within the AI Power plugin, which fails to implement proper file type validation before accepting and storing uploaded files. When a file upload request is processed, the function does not verify that the uploaded content matches expected file types (such as images), allowing attackers to submit PHP webshells, executable scripts, or other malicious payloads.

The vulnerability is particularly severe because it requires no authentication to exploit. An unauthenticated attacker can directly interact with the vulnerable upload endpoint, submit a malicious file disguised or presented as an image, and have it stored in a web-accessible location on the server. Once the malicious file is uploaded, the attacker can execute it by accessing its URL directly, achieving remote code execution on the WordPress server.

Root Cause

The root cause of CVE-2024-10392 is the absence of file type validation in the handle_image_upload function. Secure file upload implementations typically employ multiple validation layers including MIME type checking, file extension whitelisting, content verification, and magic byte analysis. The vulnerable function lacks these essential security controls, accepting any file content regardless of type. This oversight allows attackers to bypass intended restrictions and upload executable files such as PHP scripts to the server.

Attack Vector

The attack vector for this vulnerability is network-based and requires no privileges or user interaction. An attacker can craft a malicious HTTP request targeting the handle_image_upload endpoint, embedding a PHP webshell or similar payload within the upload data. The vulnerable function processes the request without validating the file content, storing the malicious file on the server. The attacker can then access the uploaded file directly via its URL to execute arbitrary commands with the privileges of the web server user.

The lack of authentication requirement makes this vulnerability particularly dangerous in automated attack scenarios, where attackers can scan for vulnerable WordPress installations and exploit them en masse. Successful exploitation grants attackers the ability to execute arbitrary code, modify site content, steal database credentials, pivot to other systems on the network, or deploy ransomware.

Detection Methods for CVE-2024-10392

Indicators of Compromise

• Unexpected PHP files or executable scripts appearing in WordPress upload directories
• Web server access logs showing POST requests to plugin endpoints with unusual file upload patterns
• Presence of webshell signatures or obfuscated PHP code in recently created files
• Outbound network connections from the web server to unfamiliar destinations

Detection Strategies

• Monitor WordPress upload directories for newly created files with executable extensions (.php, .phtml, .php5)
• Implement file integrity monitoring to detect unauthorized modifications or additions to plugin directories
• Analyze web server access logs for POST requests targeting the AI Power plugin's upload endpoints
• Deploy web application firewall (WAF) rules to block file uploads with dangerous content types

Monitoring Recommendations

• Enable WordPress audit logging to track file upload activities and plugin interactions
• Configure alerts for new file creation events in the wp-content/uploads directory hierarchy
• Monitor system processes spawned by the web server user for suspicious command execution
• Review server resource utilization for anomalies indicating cryptominer or botnet activity

How to Mitigate CVE-2024-10392

Immediate Actions Required

• Update the AI Power: Complete AI Pack plugin to the latest patched version immediately
• Audit WordPress upload directories for any suspicious or unexpected files
• Review web server access logs for evidence of exploitation attempts
• If compromise is suspected, isolate the affected server and conduct a forensic investigation

Patch Information

The vulnerability has been addressed in a plugin update. The security patch implements proper file type validation in the handle_image_upload function. Detailed changes can be reviewed in the WordPress Plugin Changeset. Additional technical information is available in the Wordfence Vulnerability Report. Site administrators should update to the patched version as soon as possible.

Workarounds

• Temporarily disable the AI Power plugin until a patch can be applied
• Implement WAF rules to block file upload requests to the vulnerable endpoint
• Restrict server-level permissions to prevent PHP execution in upload directories
• Use .htaccess or server configuration to deny direct access to uploaded files

# Apache configuration to prevent PHP execution in uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
    php_admin_flag engine Off
</Directory>