CVE-2024-13714: All-Images.ai WordPress Plugin RCE Vulnerability

CVE-2024-13714 Overview

CVE-2024-13714 is an arbitrary file upload vulnerability in the All-Images.ai – IA Image Bank and Custom Image creation plugin for WordPress. The flaw exists in the _get_image_by_url function, which fails to validate file types before writing uploaded content to disk. All plugin versions up to and including 1.0.4 are affected. Authenticated users with Subscriber-level access or higher can upload arbitrary files to the server, which may lead to remote code execution. The weakness is classified under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated attackers with minimal privileges can upload executable PHP files and achieve remote code execution on affected WordPress sites.

Affected Products

All-Images.ai – IA Image Bank and Custom Image creation plugin for WordPress
Versions 1.0.0 through 1.0.4
WordPress sites permitting Subscriber-level or higher registration

Discovery Timeline

2025-02-12 - CVE-2024-13714 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13714

Vulnerability Analysis

The All-Images.ai plugin exposes the _get_image_by_url function to authenticated users. The function accepts a URL parameter, retrieves the referenced resource, and writes it to the WordPress uploads directory. Because the function omits MIME type and file extension validation, it accepts any file the attacker supplies. An attacker with a Subscriber account can host a PHP web shell on an external server and instruct the plugin to fetch and save it under the WordPress web root. Once written, the file is directly accessible over HTTP and executes under the PHP handler. This converts a low-privilege WordPress account into full server-side code execution.

Root Cause

The root cause is missing file type validation in _get_image_by_url. The function trusts the remote URL's content and writes it to disk without verifying that the payload is an image. WordPress ships helper functions such as wp_check_filetype_and_ext and wp_handle_upload that enforce allow-lists, but the plugin does not invoke them on this code path.

Attack Vector

Exploitation requires an authenticated Subscriber account, which is trivial to obtain on sites with open registration. The attacker sends an authenticated request to the plugin endpoint that invokes _get_image_by_url, supplying a URL that points to a malicious .php file on an attacker-controlled host. The plugin downloads the file and stores it in a predictable location within wp-content/uploads/. The attacker then requests the stored file directly to trigger execution and establish a persistent foothold.

No verified proof-of-concept code is publicly available. See the
[Wordfence Vulnerability Report](https://www.wordfence.com/threat-intel/vulnerabilities/id/422c634c-5119-40ef-adf7-681c3d8c09a2?source=cve)
and the [WordPress Plugin Changeset](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3231889%40all-images-ai&new=3231889%40all-images-ai)
for the vendor patch diff.

Detection Methods for CVE-2024-13714

Indicators of Compromise

Unexpected PHP, .phtml, or .phar files inside wp-content/uploads/ subdirectories associated with the All-Images.ai plugin.
Outbound HTTP requests from the WordPress server to unfamiliar hosts triggered by the _get_image_by_url function.
New or modified administrator accounts created shortly after Subscriber-level logins.
Web server access logs showing direct GET requests to newly written files under wp-content/uploads/.

Detection Strategies

Monitor WordPress access logs for authenticated requests invoking All-Images.ai plugin endpoints followed by writes to the uploads directory.
Deploy file integrity monitoring on wp-content/uploads/ and alert on the creation of any file with a script-executable extension.
Inspect the plugin's request logs for _get_image_by_url calls that reference external URLs with non-image extensions.

Monitoring Recommendations

Alert on Subscriber-level accounts that generate plugin API traffic or outbound HTTP fetches originating from the web application server.
Baseline outbound network connections from the WordPress host and flag requests to previously unseen external domains.
Track process spawns by the PHP handler that lead to shells, curl, wget, or reverse-connect utilities.

How to Mitigate CVE-2024-13714

Immediate Actions Required

Update the All-Images.ai plugin to the patched release published after version 1.0.4, or deactivate and remove the plugin if no update is available.
Audit wp-content/uploads/ for unexpected script files and remove any confirmed web shells.
Rotate credentials for all WordPress user accounts and review the administrator user list for unauthorized additions.
Disable open user registration on sites that do not require it to eliminate the Subscriber-access precondition.

Patch Information

The vendor published a fix through the WordPress plugin repository. Review the WordPress Plugin Changeset for the exact code change and the Wordfence Vulnerability Report for advisory details. Apply the update through the WordPress admin dashboard or via WP-CLI.

Workarounds

Deactivate the All-Images.ai plugin until the patched version is installed.
Restrict PHP execution inside wp-content/uploads/ using a web server rule that denies handler mapping for .php files in that path.
Enforce a Web Application Firewall rule that blocks Subscriber-level requests to the plugin's image-fetch endpoint.
Require administrator approval for new user registrations to prevent anonymous Subscriber account creation.

bash

# Apache: block PHP execution under wp-content/uploads
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
    Require all denied
</FilesMatch>

# Nginx: equivalent location block in the site config
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}

# WP-CLI: deactivate the vulnerable plugin immediately
wp plugin deactivate all-images-ai