CVE-2024-12854: WordPress Garden Gnome Package RCE Flaw

CVE-2024-12854 Overview

The Garden Gnome Package plugin for WordPress contains an arbitrary file upload vulnerability in all versions up to and including 2.3.0. The flaw resides in the functionality that automatically extracts ggpkg files uploaded to the server. Because the plugin does not validate the file type of contents extracted from the archive, authenticated attackers with Author-level access or higher can upload arbitrary files. This behavior maps to [CWE-434: Unrestricted Upload of File with Dangerous Type] and can lead to remote code execution on the affected site.

Critical Impact
Authenticated attackers holding Author-level accounts can plant executable PHP files on the web server and achieve remote code execution, resulting in full site compromise.

Affected Products

Garden Gnome Package plugin for WordPress, all versions through 2.3.0
WordPress sites that permit Author-level (or higher) account registration or delegation
WordPress installations exposing plugin-controlled upload endpoints to authenticated users

Discovery Timeline

2025-01-08 - CVE-2024-12854 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-12854

Vulnerability Analysis

The Garden Gnome Package plugin processes uploaded ggpkg archive files by automatically extracting their contents into a directory within the WordPress installation. The extraction routine does not enforce an allowlist on the file types written to disk. As a result, an attacker can craft a ggpkg archive containing PHP or other server-executable files. Once extracted, those files reside under the web root and can be requested directly by the attacker.

Exploitation requires an authenticated session with at least Author-level privileges, which lowers the effective barrier on sites that allow open registration or grant contributor-to-author promotion. Because the attack is delivered over the network with low complexity and no user interaction, the confidentiality, integrity, and availability of the WordPress instance are all at risk.

Root Cause

The root cause is missing file type validation within the archive extraction logic. The plugin trusts the contents of the ggpkg container and writes each embedded file to the filesystem without inspecting the extension, MIME type, or magic bytes. This omission converts an archive upload feature into an arbitrary file write primitive.

Attack Vector

An authenticated attacker uploads a malicious ggpkg archive through the plugin's upload interface. The archive contains a PHP payload alongside expected package assets. The plugin extracts the archive into a web-accessible directory. The attacker then issues an HTTP request to the extracted PHP file, executing arbitrary code in the context of the web server user.

Technical details are documented in the Wordfence Vulnerability Report and the corresponding WordPress Plugin Changeset.

Detection Methods for CVE-2024-12854

Indicators of Compromise

Presence of unexpected .php, .phtml, or other executable script files inside directories created by the Garden Gnome Package plugin
Recently uploaded ggpkg archives associated with Author-level accounts that do not typically publish package content
Outbound network connections initiated by the web server process shortly after ggpkg extraction events
New or modified WordPress administrator accounts created after a ggpkg upload

Detection Strategies

Inspect the plugin's upload and extraction directories for files whose extensions fall outside the expected media set (images, JSON metadata, tile assets).
Correlate WordPress audit logs for ggpkg uploads with subsequent HTTP requests to newly created files under the plugin's asset paths.
Alert on POST requests to plugin upload endpoints followed by direct GET requests to server-side script files.

Monitoring Recommendations

Enable WordPress activity logging for media uploads and plugin actions, retaining logs for correlation with web server access logs.
Monitor web server processes for anomalous child processes such as sh, bash, python, or curl spawned from PHP-FPM or Apache workers.
Track filesystem changes under wp-content/uploads and plugin-managed directories using file integrity monitoring.

How to Mitigate CVE-2024-12854

Immediate Actions Required

Update the Garden Gnome Package plugin to a version later than 2.3.0 as soon as a fixed release is available from the vendor.
Audit all Author-level and higher WordPress accounts, disabling any that are unused, unrecognized, or created recently without justification.
Review the plugin's upload directories for unexpected script files and remove them after preserving forensic copies.
Rotate WordPress administrator credentials, API keys, and database secrets if compromise is suspected.

Patch Information

A plugin update addressing the missing file type validation is tracked in the WordPress Plugin Changeset. Site administrators should apply the patched release through the WordPress plugin manager and verify the installed version is greater than 2.3.0.

Workarounds

Deactivate the Garden Gnome Package plugin until a patched version is installed.
Restrict Author-level and higher accounts to trusted users and disable open registration for elevated roles.
Configure the web server to deny execution of PHP files within the plugin's upload and extraction directories.
Deploy a web application firewall rule to block uploads of ggpkg archives containing executable file extensions.

bash

# Example Apache configuration to block PHP execution in plugin upload paths
<Directory "/var/www/html/wp-content/uploads/ggpkg/">
    <FilesMatch "\.(php|phtml|phar|php[3-8])$">
        Require all denied
    </FilesMatch>
</Directory>