CVE-2024-13418: G5plus April WordPress RCE Vulnerability

CVE-2024-13418 Overview

CVE-2024-13418 is an arbitrary file upload vulnerability affecting multiple G5Plus WordPress themes, including april, auteur, benaa, and beyot. The flaw resides in the ajaxUploadFonts() function, which lacks a proper capability check. Authenticated attackers with Subscriber-level access or higher can upload arbitrary files to affected sites. Successful exploitation enables remote code execution on the underlying web server. According to the disclosure, the issue was escalated to Envato over two months prior to publication and remains only partially patched. The vulnerability is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated Subscriber-level users can upload arbitrary files through the ajaxUploadFonts() handler, leading to remote code execution on vulnerable WordPress sites.

Affected Products

G5Plus April WordPress theme
G5Plus Auteur WordPress theme
G5Plus Benaa WordPress theme
G5Plus Beyot WordPress theme

Discovery Timeline

2025-05-02 - CVE-2024-13418 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13418

Vulnerability Analysis

The vulnerability affects the AJAX-registered ajaxUploadFonts() function bundled with multiple G5Plus commercial WordPress themes distributed through the Envato ThemeForest marketplace. The function is designed to allow administrators to upload custom font files to the site. However, the handler registers itself against the wp_ajax_ action hook without a corresponding current_user_can() capability check.

Any WordPress user who can authenticate, including default Subscriber accounts created through open registration, can invoke the endpoint. The absence of file extension and MIME type validation allows attackers to submit PHP files instead of font assets. Once the file is written to a web-accessible directory, the attacker requests it directly to trigger code execution under the web server context.

Root Cause

The root cause is a missing authorization check combined with insufficient input validation on uploaded files. The ajaxUploadFonts() function does not verify that the calling user has the manage_options or upload_files capability. It also fails to enforce a strict allowlist of accepted file types, permitting PHP scripts and other executable content to be written to the filesystem.

Attack Vector

An attacker first registers or acquires any authenticated WordPress account on the target site. The attacker then sends a crafted multipart/form-data POST request to /wp-admin/admin-ajax.php targeting the vulnerable font upload action, with a malicious PHP payload attached. The server writes the payload to the theme's font directory. The attacker then requests the uploaded file URL to execute arbitrary commands as the web server user.

The vulnerability manifests in the ajaxUploadFonts() AJAX handler. Refer to the Wordfence vulnerability report for additional technical detail.

Detection Methods for CVE-2024-13418

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with an action parameter referencing font uploads from low-privileged accounts
Files with .php, .phtml, or .phar extensions present under theme font directories such as wp-content/uploads/ or wp-content/themes/<theme>/assets/fonts/
Unexpected outbound network connections originating from the PHP-FPM or Apache process
New WordPress user registrations closely followed by AJAX upload activity

Detection Strategies

Inspect web server access logs for admin-ajax.php requests with the font upload action originating from newly registered accounts
Monitor filesystem changes in theme and upload directories using file integrity monitoring for creation of executable script files
Review WordPress audit logs for Subscriber-level accounts invoking administrative-tier AJAX endpoints

Monitoring Recommendations

Enable verbose logging for wp-admin/admin-ajax.php and correlate request bodies with authenticated user roles
Alert on any PHP process spawning shell interpreters such as sh, bash, or python from web content directories
Track outbound HTTP or DNS requests initiated by the web server user to identify post-exploitation callbacks

How to Mitigate CVE-2024-13418

Immediate Actions Required

Disable open user registration on affected WordPress sites until a full patch is available
Audit existing user accounts and remove untrusted Subscriber-level accounts
Scan the wp-content/ directory tree for unexpected PHP files and remove any that are not part of the legitimate installation
Restrict access to /wp-admin/admin-ajax.php at the web application firewall (WAF) layer for known-abusive action names

Patch Information

According to the disclosure, the vendor issued a partial patch after escalation to Envato, but the affected G5Plus themes (april, auteur, benaa, beyot) remain vulnerable as of publication. Site owners should monitor the ThemeForest product pages for updated releases and apply any new versions immediately once available.

Workarounds

Deploy a WAF rule that blocks multipart/form-data uploads containing .php or other executable extensions to admin-ajax.php
Configure the web server to deny PHP execution within wp-content/uploads/ and theme font directories using an .htaccess or Nginx location directive
Temporarily switch to a non-affected theme if business requirements allow
Remove or rename the vulnerable ajaxUploadFonts() handler if a custom hotfix can be maintained until the vendor delivers a complete patch

bash

# Nginx: deny PHP execution inside WordPress upload and theme font directories
location ~* ^/wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}

location ~* ^/wp-content/themes/.*/assets/fonts/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}