CVE-2024-13890: Sksdev Allow PHP Execute RCE Vulnerability

CVE-2024-13890 Overview

The Allow PHP Execute plugin for WordPress contains a PHP Code Injection vulnerability [CWE-94] affecting all versions up to and including 1.0. The plugin permits PHP code entry for any user with the unfiltered_html capability. Authenticated attackers with Editor-level access or higher can inject arbitrary PHP into posts and pages, leading to code execution on the underlying web server.

Critical Impact
Attackers with Editor privileges can execute arbitrary PHP on the WordPress host, resulting in full compromise of site content, database access, and potential lateral movement to the underlying server.

Affected Products

sksdev Allow PHP Execute plugin for WordPress
Versions up to and including 1.0
All WordPress sites where Editor-level (or higher) users are not fully trusted

Discovery Timeline

2025-03-08 - CVE-2024-13890 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13890

Vulnerability Analysis

The Allow PHP Execute plugin extends WordPress by evaluating PHP code embedded inside post and page content. The plugin gates this behavior on the unfiltered_html capability, which by default is granted to Editor and Administrator roles on single-site installations. Any user holding that capability can therefore submit PHP that the plugin executes on render.

This converts a content-authoring privilege into a code-execution privilege. WordPress role separation assumes Editors cannot reach the server runtime; the plugin breaks that assumption by treating post content as executable PHP. Consequences include web shell installation, credential theft from wp-config.php, database exfiltration, and pivoting into adjacent hosts.

Root Cause

The root cause is unsafe evaluation of user-supplied content. The plugin passes post body input into a PHP execution sink without restricting the operations available or sandboxing the runtime. The permission check on unfiltered_html is not a security boundary for code execution, because that capability was designed to allow raw HTML, not server-side scripting. This is a classic instance of CWE-94: Improper Control of Generation of Code.

Attack Vector

Exploitation requires an authenticated session with Editor privileges or higher. The attacker creates or edits a post or page, embeds a PHP payload inside the content, and saves it. When the plugin processes the post, the embedded PHP is executed in the WordPress process context. See the WordPress Plugin Code Review and the Wordfence Vulnerability Report for the vulnerable code path.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose only.

Detection Methods for CVE-2024-13890

Indicators of Compromise

Presence of the allow-php-execute plugin directory under wp-content/plugins/
Post or page revisions containing PHP tags such as <?php inside wp_posts.post_content
Unexpected outbound network connections from the PHP-FPM or Apache worker process on the WordPress host
New PHP files written under wp-content/uploads/ or the WordPress document root shortly after post edits

Detection Strategies

Query the wp_posts table for post_content values containing <?php, eval(, base64_decode(, or system(
Audit the WordPress users and usermeta tables for accounts with the editor or administrator role and correlate against recent post edits
Monitor plugin activation events in wp_options and site audit logs for enablement of allow-php-execute

Monitoring Recommendations

Alert on child processes spawned by the web server user (www-data, apache, nginx) such as sh, bash, curl, wget, or python
Track file integrity on the WordPress installation to catch webshell drops and modifications to wp-config.php
Log and review WordPress admin authentication events, especially Editor-level logins from new IP addresses or geographies

How to Mitigate CVE-2024-13890

Immediate Actions Required

Deactivate and delete the Allow PHP Execute plugin from all WordPress installations
Review all Editor and Administrator accounts and remove any that are unnecessary or inactive
Scan post and page content for embedded PHP and remove any unauthorized code
Rotate WordPress admin passwords and any secrets stored in wp-config.php if compromise is suspected

Patch Information

No fixed version is listed in the enriched data. All versions up to and including 1.0 are affected. Because the plugin's stated purpose is to execute arbitrary PHP from post content, the safest remediation is removal rather than patching. Refer to the Wordfence Vulnerability Report for updated guidance.

Workarounds

Remove the unfiltered_html capability from the Editor role while the plugin remains installed
Restrict PHP execution in the WordPress content directory using web server configuration or disable_functions in php.ini
Enforce multi-factor authentication for all Editor and Administrator accounts to reduce the risk of credential-based abuse
Place the WordPress site behind a web application firewall configured to block PHP tags in post submissions

bash

# Configuration example: remove unfiltered_html from Editor role via WP-CLI
wp cap remove editor unfiltered_html

# Verify the plugin is no longer active
wp plugin deactivate allow-php-execute
wp plugin delete allow-php-execute