CVE-2024-13448: Themerex Addons RCE Vulnerability

CVE-2024-13448 Overview

The ThemeREX Addons plugin for WordPress contains a critical arbitrary file upload vulnerability in the trx_addons_uploads_save_data function. Due to missing file type validation, all versions up to and including 2.32.3 are susceptible to exploitation by unauthenticated attackers who can upload arbitrary files to the affected site's server, potentially enabling remote code execution.

Critical Impact

Unauthenticated attackers can upload malicious files (such as PHP web shells) to WordPress sites using vulnerable versions of ThemeREX Addons, potentially leading to complete server compromise and remote code execution.

Affected Products

• ThemeREX Addons plugin for WordPress versions up to and including 2.32.3
• WordPress sites using the Qwery Multipurpose Business WordPress Theme with bundled ThemeREX Addons
• Any WordPress installation with the vulnerable ThemeREX Addons plugin installed

Discovery Timeline

• 2025-01-28 - CVE-2024-13448 published to NVD
• 2025-01-30 - Last updated in NVD database

Technical Details for CVE-2024-13448

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The trx_addons_uploads_save_data function within the ThemeREX Addons plugin fails to implement proper file type validation, creating a dangerous attack surface. The vulnerability is particularly severe because it requires no authentication to exploit, meaning any internet-connected attacker can target vulnerable WordPress installations without needing valid credentials.

The attack can be executed remotely over the network with low complexity, requiring no user interaction. Successful exploitation grants attackers the ability to compromise the confidentiality, integrity, and availability of the affected system entirely.

Root Cause

The root cause of CVE-2024-13448 lies in the missing file type validation within the trx_addons_uploads_save_data function. When processing file uploads, the function does not verify that uploaded files conform to expected or safe file types. This oversight allows attackers to upload executable files such as PHP scripts, which can then be accessed directly through the web server to execute arbitrary commands.

Proper secure file upload implementation should include:

• Whitelist validation of allowed file extensions
• MIME type verification
• File content inspection
• Randomized file naming and secure storage locations

Attack Vector

The attack vector for this vulnerability is network-based, allowing remote exploitation. An attacker can craft a malicious HTTP request targeting the vulnerable upload endpoint exposed by the ThemeREX Addons plugin. The exploitation workflow typically involves:

1. Identifying a WordPress site running a vulnerable version of ThemeREX Addons
2. Crafting a specially formatted HTTP POST request to the upload endpoint
3. Uploading a malicious PHP file (such as a web shell) disguised or directly as an executable script
4. Accessing the uploaded file via the web server to achieve remote code execution

The vulnerability requires no prior authentication, making mass exploitation of vulnerable WordPress sites straightforward for threat actors. Once a web shell is uploaded, attackers gain persistent access to execute arbitrary commands, exfiltrate data, or pivot to other systems on the network.

Detection Methods for CVE-2024-13448

Indicators of Compromise

• Unexpected PHP files or other executable scripts in WordPress upload directories (typically wp-content/uploads/)
• Web server access logs showing POST requests to ThemeREX Addons upload endpoints from unknown IP addresses
• Suspicious outbound network connections originating from the web server
• Newly created or modified files with recent timestamps in plugin directories
• Evidence of web shell activity such as command execution patterns in server logs

Detection Strategies

• Monitor WordPress upload directories for newly created files with executable extensions (.php, .phtml, .php5, etc.)
• Implement file integrity monitoring (FIM) to detect unauthorized file changes in the WordPress installation
• Review web server access logs for unusual POST requests targeting ThemeREX Addons endpoints
• Deploy web application firewall (WAF) rules to detect and block file upload attacks
• Use WordPress security plugins to scan for known web shell signatures

Monitoring Recommendations

• Enable detailed logging on web servers and WordPress installations to capture file upload events
• Configure real-time alerts for new PHP files created in upload directories
• Monitor for anomalous process execution originating from web server processes (e.g., www-data spawning shell processes)
• Implement network monitoring to detect command and control (C2) traffic from compromised servers
• Regularly audit installed WordPress plugins and their versions against known vulnerability databases

How to Mitigate CVE-2024-13448

Immediate Actions Required

• Update ThemeREX Addons plugin to a version newer than 2.32.3 immediately
• Conduct a thorough scan of WordPress upload directories for suspicious or unexpected files
• Review web server access logs for evidence of exploitation attempts
• Consider temporarily disabling the ThemeREX Addons plugin until patching is complete
• Implement web application firewall rules to block malicious file upload attempts

Patch Information

Organizations should update the ThemeREX Addons plugin to the latest available version that addresses this vulnerability. The fix should be available through the standard WordPress plugin update mechanism or through the ThemeForest Product Page if the plugin is bundled with a premium theme. For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Workarounds

• Restrict access to WordPress admin and upload endpoints using IP-based access controls
• Implement server-side file upload restrictions that block executable file types at the web server level
• Use a web application firewall (WAF) configured with rules to prevent arbitrary file uploads
• Disable direct PHP execution in upload directories via web server configuration
• Monitor and audit plugin activity using WordPress security plugins such as Wordfence

# Apache configuration to prevent PHP execution in uploads directory
# Add to .htaccess file in wp-content/uploads/
<FilesMatch "\.(?:php|phtml|php5|php7|phps)$">
    Require all denied
</FilesMatch>

# Nginx configuration alternative
# Add to server block
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}