CVE-2024-10590 Overview
CVE-2024-10590 is an arbitrary file upload vulnerability in the Opt-In Downloads plugin for WordPress. The flaw exists in the admin_upload() function, which lacks file type validation across all versions up to and including 4.07. Authenticated attackers with Subscriber-level access or above can upload arbitrary files to the affected site's server. This can lead to remote code execution (RCE) on servers where the plugin's .htaccess protections are not honored, such as NGINX deployments. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type).
Critical Impact
Authenticated Subscriber-level users can upload arbitrary files, potentially achieving remote code execution on NGINX-hosted WordPress sites.
Affected Products
- Opt-In Downloads plugin for WordPress — all versions up to and including 4.07
- WordPress installations running on NGINX (RCE path)
- WordPress installations where .htaccess restrictions are unenforced or bypassable
Discovery Timeline
- 2024-12-12 - CVE-2024-10590 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10590
Vulnerability Analysis
The Opt-In Downloads plugin exposes an admin_upload() function used to handle file uploads through the plugin's administrative interface. The function does not validate the MIME type or extension of the uploaded file. Any authenticated user, including low-privilege Subscriber accounts, can invoke this endpoint and place attacker-controlled files onto the server.
Because WordPress subscriber registration is often open by default, the barrier to exploitation is low on many sites. Once a malicious PHP file is written to a web-accessible directory, an attacker can request it directly to trigger code execution. The plugin ships with an .htaccess file that blocks PHP execution in the upload path, but this control only functions on Apache. NGINX ignores .htaccess files entirely, leaving the RCE path open on those deployments.
Root Cause
The root cause is missing file type validation in the admin_upload() handler. The function accepts uploaded content without verifying extension, MIME type, or file magic bytes. It also fails to enforce a capability check appropriate to the sensitivity of the operation, granting Subscriber-level users access to functionality that should be restricted to administrators.
Attack Vector
An authenticated attacker sends a crafted multipart HTTP POST request to the plugin's upload endpoint, submitting a PHP webshell or other executable payload. The plugin stores the file in a predictable location under the WordPress uploads directory. On NGINX servers, the attacker then issues a direct HTTP GET request to the uploaded file to execute arbitrary PHP code in the context of the web server user. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-10590
Indicators of Compromise
- New PHP, PHTML, or executable files in the Opt-In Downloads plugin upload directory under wp-content/uploads/
- HTTP POST requests to the plugin's admin_upload endpoint originating from low-privilege user sessions
- Direct HTTP GET requests to unusual file paths in the plugin's upload directory returning HTTP 200
- Outbound network connections initiated by the PHP-FPM or web server worker process shortly after an upload event
Detection Strategies
- Monitor WordPress access logs for POST requests to admin-ajax.php or plugin endpoints referencing admin_upload from Subscriber accounts
- Alert on creation of files with server-executable extensions inside wp-content/uploads/ subdirectories
- Correlate authenticated session activity from newly registered accounts with file write events on the web root
Monitoring Recommendations
- Enable file integrity monitoring across the WordPress wp-content tree
- Ingest web server and PHP-FPM logs into a centralized platform and retain them for correlation with endpoint telemetry
- Track WordPress user registrations and immediate post-registration activity for anomalous upload behavior
How to Mitigate CVE-2024-10590
Immediate Actions Required
- Deactivate and remove the Opt-In Downloads plugin until a patched version is confirmed available from the vendor
- Audit wp-content/uploads/ for unexpected PHP or executable files and remove any unauthorized artifacts
- Review recent Subscriber-level registrations and revoke accounts that are not associated with legitimate users
- Disable open user registration in WordPress settings if it is not required
Patch Information
No patched version has been documented at the time of NVD publication. All versions through 4.07 remain vulnerable. Consult the Wordfence Vulnerability Report and the Codecanyon Item Overview for updated vendor status.
Workarounds
- On NGINX, configure the server block to deny execution of PHP files within wp-content/uploads/ since .htaccess is not honored
- Restrict access to the plugin's upload endpoint using a web application firewall rule that blocks non-administrator sessions
- Enforce capability checks by placing the WordPress site behind an authentication proxy that limits Subscriber account actions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
