CVE-2024-1311: Brizy Page Builder RCE Vulnerability

CVE-2024-1311 Overview

CVE-2024-1311 is an arbitrary file upload vulnerability in the Brizy – Page Builder plugin for WordPress. The flaw exists in the storeImages function, which fails to validate file types before writing uploaded content to the server. All plugin versions up to and including 2.4.40 are affected. Authenticated users with contributor-level access or higher can upload arbitrary files, potentially leading to remote code execution on the WordPress host. The issue is tracked under CWE-434 (Unrestricted Upload of File with Dangerous Type) and was addressed in version 2.4.41.

Critical Impact
Contributor-level accounts can upload executable files such as PHP scripts, enabling full remote code execution on the underlying WordPress server.

Affected Products

Brizy – Page Builder plugin for WordPress, all versions through 2.4.40
WordPress installations running the free Brizy distribution
Sites where contributor role or higher is assigned to untrusted users

Discovery Timeline

2024-03-13 - CVE-2024-1311 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1311

Vulnerability Analysis

The Brizy page builder exposes a storeImages function within editor/zip/archiver.php that processes files supplied by authenticated users. The function writes files to the WordPress uploads directory without verifying MIME type, file extension, or content signature. An attacker with contributor permissions can therefore submit a PHP payload disguised as an image and have it stored under a web-accessible path.

Because WordPress executes PHP files placed within the uploads directory when the server configuration allows, the primary consequence is arbitrary code execution in the context of the web server. The attacker gains the same privileges as the WordPress process, which typically permits database access, credential theft, and lateral movement into other tenants on shared hosts.

Root Cause

The root cause is missing input validation on user-controlled file uploads. The storeImages handler trusts the client-supplied filename and content, and does not enforce an allowlist of image extensions or verify magic bytes before persisting the file. This maps directly to CWE-434.

Attack Vector

Exploitation requires an authenticated session with at least the contributor role. The attacker sends a crafted request to the Brizy upload endpoint containing a PHP file, then requests the stored file directly from the uploads path to trigger execution. No user interaction is required beyond the attacker's own authentication. Technical details are documented in the Wordfence Vulnerability Report and the vulnerable code is visible in the Brizy plugin source.

Detection Methods for CVE-2024-1311

Indicators of Compromise

Files with executable extensions such as .php, .phtml, or .phar in the WordPress wp-content/uploads/ tree, particularly under Brizy-managed subdirectories
HTTP POST requests to Brizy editor endpoints from contributor accounts followed by direct GET requests to newly created files in uploads
Newly created contributor accounts followed shortly by upload activity to Brizy paths
Web shells or obfuscated PHP code discovered in Brizy asset directories

Detection Strategies

Inspect WordPress access logs for uploads to Brizy paths where the response references a non-image extension
Monitor file integrity across wp-content/uploads/ and alert on the creation of executable file types
Correlate authentication events for contributor and author roles with subsequent file upload activity in Brizy endpoints
Search for PHP execution originating from the uploads directory in the web server process tree

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and Brizy plugin endpoints to capture upload payloads and filenames
Forward web server and WordPress audit logs to a centralized analytics platform for retention and correlation
Alert on process creation where the parent is the PHP-FPM or Apache worker and the script path resides in the uploads tree

How to Mitigate CVE-2024-1311

Immediate Actions Required

Update the Brizy – Page Builder plugin to version 2.4.41 or later on all WordPress sites
Audit user accounts with contributor role or higher and remove any that are unused or untrusted
Scan wp-content/uploads/ for existing PHP files or other unexpected executable content and remove any web shells
Rotate WordPress administrator and database credentials if compromise is suspected

Patch Information

The Brizy maintainers fixed the missing file type validation in version 2.4.41. Review the corrective commit in the WordPress Brizy Change Set for the updated archiver.php logic. Upgrading through the WordPress plugin manager or by replacing the plugin directory with the patched release remediates the vulnerability.

Workarounds

Deactivate the Brizy plugin until the update to 2.4.41 or later can be applied
Restrict the contributor and author roles so untrusted users cannot access Brizy editor endpoints
Configure the web server to deny PHP execution within wp-content/uploads/ using directory-level rules
Deploy a web application firewall rule that blocks uploads with executable extensions to Brizy paths

bash

# Configuration example: deny PHP execution in WordPress uploads (Apache)
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php7|php8)$">
        Require all denied
    </FilesMatch>
</Directory>