CVE-2024-13091: Wpbot Wpot WordPress Plugin RCE Vulnerability

CVE-2024-13091 Overview

The WPBot Pro WordPress Chatbot plugin for WordPress contains a critical arbitrary file upload vulnerability in the qcld_wpcfb_file_upload function. This security flaw exists due to missing file type validation, allowing unauthenticated attackers to upload arbitrary files to the affected site's server. Successful exploitation may enable remote code execution, potentially compromising the entire WordPress installation and underlying server infrastructure.

Critical Impact

Unauthenticated attackers can upload malicious files including web shells to vulnerable WordPress installations, potentially achieving full server compromise and remote code execution.

Affected Products

• WPBot Pro WordPress Chatbot versions up to and including 13.5.4
• ChatBot Conversational Forms plugin (required for exploitation)
• Conversational Form Builder Pro addon plugin (required for exploitation)

Discovery Timeline

• 2025-01-22 - CVE CVE-2024-13091 published to NVD
• 2025-01-24 - Last updated in NVD database

Technical Details for CVE-2024-13091

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The core issue lies in the qcld_wpcfb_file_upload function within the WPBot Pro plugin, which processes file uploads from conversational forms without proper validation of file types. The function fails to implement server-side checks to verify that uploaded files conform to allowed file extensions or MIME types.

Because the vulnerable function can be accessed by unauthenticated users, attackers do not need any credentials or special privileges to exploit this flaw. The attack can be conducted remotely over the network without any user interaction required. A successful attack results in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of CVE-2024-13091 is the absence of file type validation in the qcld_wpcfb_file_upload function. When processing file uploads through conversational forms, the plugin accepts any file type without verifying that it matches an allowed whitelist. This architectural oversight enables attackers to bypass intended restrictions and upload executable files such as PHP web shells directly to the WordPress server.

Attack Vector

The attack requires a WordPress installation with three specific plugins configured together: WPBot Pro, ChatBot Conversational Forms, and Conversational Form Builder Pro addon. An unauthenticated attacker can craft a malicious HTTP request targeting the vulnerable file upload endpoint. By submitting a request containing a PHP file or other executable payload, the attacker can place malicious code directly on the server.

Once a malicious file is uploaded, the attacker can access it via a direct HTTP request to the uploaded file's location, triggering code execution with the privileges of the web server process. This typically allows the attacker to execute arbitrary system commands, access the WordPress database, modify site content, steal credentials, pivot to other systems on the network, or deploy ransomware.

Detection Methods for CVE-2024-13091

Indicators of Compromise

• Unexpected PHP files or web shells appearing in WordPress upload directories
• Suspicious HTTP POST requests to conversational form file upload endpoints
• New files with executable extensions (.php, .phtml, .phar) in unexpected locations
• Web server logs showing access to recently uploaded unknown files

Detection Strategies

• Monitor file system changes in WordPress plugin and upload directories for new executable files
• Implement Web Application Firewall (WAF) rules to block file uploads containing PHP code or executable content
• Review HTTP access logs for anomalous POST requests to WPBot-related endpoints
• Deploy file integrity monitoring solutions to detect unauthorized file creation

Monitoring Recommendations

• Enable real-time file system monitoring on WordPress installations using SentinelOne Singularity Platform
• Configure alerts for new file creation events in WordPress plugin directories
• Implement logging and alerting for all file upload activities through the conversational forms feature
• Monitor outbound network connections from the web server for potential command-and-control communication

How to Mitigate CVE-2024-13091

Immediate Actions Required

• Update WPBot Pro WordPress Chatbot plugin to a version newer than 13.5.4 as soon as a patch is available
• Temporarily disable the ChatBot Conversational Forms plugin and Conversational Form Builder Pro addon to eliminate the attack vector
• Audit WordPress upload directories for any suspicious or unauthorized files
• Review web server access logs for evidence of exploitation attempts

Patch Information

Organizations should monitor the WPBot Pro official website for security updates addressing this vulnerability. Additionally, the Wordfence Vulnerability Report provides ongoing tracking of this issue. Apply vendor patches immediately upon release and verify the update resolves the file type validation issue.

Workarounds

• Disable file upload functionality in conversational forms until a patch is available
• Implement server-side file upload restrictions using .htaccess rules to block execution of uploaded files
• Deploy a Web Application Firewall with rules specifically blocking dangerous file uploads
• Restrict access to the WordPress admin and plugin directories using IP allowlisting where feasible

# Apache .htaccess configuration to prevent PHP execution in uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(?:php|phtml|phar|php[0-9])$">
    Order Allow,Deny
    Deny from all
</FilesMatch>