CVE-2024-13707: WP Image Uploader CSRF Vulnerability

CVE-2024-13707 Overview

CVE-2024-13707 affects the WP Image Uploader plugin for WordPress in all versions up to and including 1.0.1. The plugin fails to implement nonce validation in the gky_image_uploader_main_function() function, exposing it to Cross-Site Request Forgery [CWE-352]. Unauthenticated attackers can delete arbitrary files on the server by tricking an authenticated administrator into clicking a malicious link. File deletion on a WordPress installation can lead to remote code execution when critical files such as wp-config.php are removed, forcing the site into a fresh setup state.

Critical Impact

Unauthenticated attackers can delete arbitrary files on affected WordPress sites by tricking administrators into clicking a crafted link, potentially leading to site takeover.

Affected Products

• Ivanm WP Image Uploader plugin for WordPress
• All versions up to and including 1.0.1
• WordPress sites with the plugin installed and activated

Discovery Timeline

• 2025-01-30 - CVE-2024-13707 published to NVD
• 2025-01-31 - Last updated in NVD database

Technical Details for CVE-2024-13707

Vulnerability Analysis

The vulnerability resides in the gky_image_uploader_main_function() function within the WP Image Uploader plugin. The function processes file operations including deletion requests but does not validate a WordPress nonce token before executing those operations. WordPress nonces are the framework's standard defense against Cross-Site Request Forgery, binding sensitive state-changing actions to an authenticated session.

Without this check, the plugin accepts any request that arrives with a valid administrator session cookie. An attacker can craft a malicious HTML page or link that triggers the file deletion endpoint when an administrator visits it. The browser automatically attaches the session cookie, and the plugin processes the request as if the administrator initiated it.

The attack requires user interaction from a privileged user but no authentication on the attacker's side. Successful exploitation results in arbitrary file deletion on the underlying server, which can disrupt site operation or chain into more severe outcomes.

Root Cause

The root cause is missing or incorrect nonce validation in gky_image_uploader_main_function(). The function lacks calls to check_admin_referer() or wp_verify_nonce() before processing the file deletion logic, violating WordPress secure coding guidelines for state-changing operations.

Attack Vector

The attack is delivered over the network and requires the target administrator to click a malicious link or load attacker-controlled content. The attacker hosts a page containing a forged request, typically an auto-submitting HTML form or image tag pointing at the vulnerable plugin endpoint. When the administrator's browser issues the request, the plugin deletes the specified file. Deletion of wp-config.php is a documented escalation path because WordPress treats a missing configuration file as a new installation, allowing the attacker to point the site at a database under their control.

No verified public exploit code is available. See the Wordfence Vulnerability Report and the WordPress Image Uploader Code for technical details on the vulnerable function.

Detection Methods for CVE-2024-13707

Indicators of Compromise

• Unexpected deletion of files within the WordPress installation directory, particularly wp-config.php, theme files, or plugin files.
• WordPress site suddenly displaying the installation setup wizard despite being previously configured.
• HTTP requests in web server logs targeting WP Image Uploader endpoints with Referer headers pointing to external or suspicious domains.
• Administrator browser sessions immediately preceding file deletion events, correlated by timestamp.

Detection Strategies

• Audit installed WordPress plugins for wp-image-uploader at version 1.0.1 or earlier.
• Inspect web server access logs for requests to the plugin's PHP endpoints originating from cross-origin referrers.
• Monitor file integrity on the WordPress webroot using tools such as inotify, auditd, or WordPress-specific integrity scanners.
• Review WordPress activity logs for administrator actions that do not match known administrative workflows.

Monitoring Recommendations

• Enable file integrity monitoring on the WordPress installation directory with alerting on deletions in wp-content/ and the webroot.
• Forward web server access logs and PHP error logs to a centralized logging system for correlation and retention.
• Alert on HTTP requests to plugin endpoints lacking valid same-origin referrers when those endpoints perform state-changing actions.
• Track administrator login sessions and correlate them with sensitive file operations on the host.

How to Mitigate CVE-2024-13707

Immediate Actions Required

• Deactivate and remove the WP Image Uploader plugin until a patched version is available, since all releases up to 1.0.1 are vulnerable.
• Verify the integrity of wp-config.php and other critical WordPress files, restoring from backup if any have been deleted.
• Instruct administrators to log out of WordPress sessions before browsing untrusted sites and to avoid clicking unsolicited links.
• Rotate WordPress administrator credentials and database credentials if any tampering is suspected.

Patch Information

At the time of publication, no fixed version has been identified in the available advisories. The vulnerability affects all versions up to and including 1.0.1. Site operators should consult the Wordfence Vulnerability Report and the WordPress plugin repository for updates, and remove the plugin until a patched release is published.

Workarounds

• Remove the WP Image Uploader plugin entirely if image upload functionality is not required.
• Deploy a web application firewall rule that blocks requests to the plugin's endpoints when the Referer header is missing or cross-origin.
• Restrict access to the WordPress admin area by IP allowlist or VPN to reduce the population of users who can be targeted.
• Configure the SameSite=Strict attribute on WordPress authentication cookies where compatible to limit cross-site request delivery.

# Example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate wp-image-uploader
wp plugin delete wp-image-uploader

# Example: restrict wp-admin via Apache .htaccess allowlist
# <Files wp-login.php>
#   Require ip 203.0.113.0/24
# </Files>