CVE-2024-10960 Overview
The Brizy – Page Builder plugin for WordPress contains an arbitrary file upload vulnerability in the storeUploads function. The flaw affects all versions up to and including 2.6.4. Missing file type validation allows authenticated users with Contributor-level access or higher to upload files of any type to the server. Successful exploitation can lead to remote code execution on the affected WordPress site. The vulnerability is tracked as [CWE-434: Unrestricted Upload of File with Dangerous Type].
Critical Impact
Authenticated attackers with Contributor privileges can upload arbitrary files, including PHP webshells, enabling remote code execution and full site compromise.
Affected Products
- Brizy – Page Builder plugin for WordPress, all versions up to and including 2.6.4
- WordPress installations with the Brizy plugin activated
- Sites allowing Contributor-level user registration or with existing Contributor accounts
Discovery Timeline
- 2025-02-12 - CVE-2024-10960 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10960
Vulnerability Analysis
The vulnerability resides in the storeUploads function within the Brizy plugin's editor/zip/archiver.php file. The function processes uploaded archive contents without validating file extensions or MIME types against an allowlist. Attackers can therefore submit PHP files, executable scripts, or other dangerous content through the plugin's upload workflow.
Because the endpoint is exposed to any authenticated user at Contributor level or above, the attack surface extends to any WordPress site allowing content contributors. The uploaded files land in a web-accessible directory, permitting direct execution through an HTTP request to the uploaded resource.
Root Cause
The root cause is the absence of file type validation in the storeUploads function. The plugin trusts client-supplied file names and content when extracting or storing uploaded archives. Neither extension checks, MIME sniffing, nor path canonicalization enforcement is applied before the file is written to disk under the WordPress uploads structure.
Attack Vector
Exploitation requires network access to the WordPress admin interface and valid credentials for a Contributor, Author, Editor, or Administrator account. The attacker authenticates, invokes the vulnerable upload endpoint exposed by Brizy, and submits a payload containing a PHP webshell. Once written to the server, the attacker requests the payload URL directly, causing the webserver to execute the PHP code with the privileges of the web process.
No verified public proof-of-concept exploit code is currently referenced in the advisory. Technical detail on the vulnerable code path is available in the Wordfence Vulnerability Report and the fix can be inspected in the WordPress Brizy Changeset.
Detection Methods for CVE-2024-10960
Indicators of Compromise
- Unexpected .php, .phtml, or .phar files written to the WordPress wp-content/uploads/brizy directory tree
- POST requests to Brizy plugin endpoints from Contributor accounts followed by GET requests to newly created files in uploads directories
- New or recently modified user accounts at Contributor level or above with unusual upload activity
- Web server access logs showing execution of scripts inside uploads paths, which should normally serve only static media
Detection Strategies
- Monitor file integrity on wp-content/uploads and alert on creation of executable file types in directories intended for media
- Inspect Brizy plugin request patterns for archive uploads followed by direct requests to extracted content
- Correlate WordPress authentication logs with subsequent upload activity to identify anomalous Contributor behavior
Monitoring Recommendations
- Enable web application firewall logging for all requests to admin-ajax.php and Brizy REST endpoints
- Track outbound network connections from PHP-FPM or webserver processes that could indicate webshell command-and-control activity
- Review WordPress role assignments regularly and alert on privilege changes for Contributor and higher roles
How to Mitigate CVE-2024-10960
Immediate Actions Required
- Update the Brizy – Page Builder plugin to version 2.6.5 or later immediately
- Audit all Contributor, Author, Editor, and Administrator accounts and remove unused or suspicious users
- Scan the wp-content/uploads directory tree for unauthorized PHP or script files and remove any that are found
- Rotate WordPress credentials and API keys if evidence of exploitation exists
Patch Information
The vendor fixed the issue in Brizy version 2.6.5. The patch adds file type validation to the storeUploads function in editor/zip/archiver.php. The code change is available in the WordPress Brizy Changeset. Administrators should apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Deactivate the Brizy plugin until the update to 2.6.5 or later can be applied
- Restrict Contributor-level and higher account creation and disable open registration for privileged roles
- Block execution of PHP files inside wp-content/uploads using webserver configuration, for example an Apache .htaccessDeny from all rule for .php files or an Nginx location block returning 403 for script extensions
- Deploy a web application firewall rule to block requests carrying archive uploads to Brizy endpoints from untrusted users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
