CVE-2024-13908: Bestwebsoft SMTP RCE Vulnerability

CVE-2024-13908 Overview

CVE-2024-13908 is an arbitrary file upload vulnerability in the SMTP by BestWebSoft plugin for WordPress. The flaw resides in the save_options function, which fails to validate file types during upload operations. All versions up to and including 1.1.9 are affected. Authenticated attackers holding Administrator-level access or higher can upload arbitrary files to the server, potentially leading to remote code execution. The vulnerability is tracked under [CWE-434] (Unrestricted Upload of File with Dangerous Type). The issue was patched in the WordPress plugin repository via changeset 3250935.

Critical Impact
Attackers with administrative access can upload executable files to the WordPress server, enabling remote code execution and full site compromise.

Affected Products

BestWebSoft SMTP plugin for WordPress, versions up to and including 1.1.9
WordPress installations with the bws-smtp plugin enabled
Any site configuration relying on the vulnerable class-bwssmtp-settings.php component

Discovery Timeline

2025-03-08 - CVE-2024-13908 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13908

Vulnerability Analysis

The vulnerability exists in the save_options function within includes/class-bwssmtp-settings.php of the SMTP by BestWebSoft plugin. The function processes plugin configuration updates, including file uploads, but omits validation of the uploaded file's MIME type or extension. This absence of validation allows uploads of executable content such as PHP scripts.

An attacker who has already obtained Administrator credentials can submit a crafted request to the plugin's settings handler and place an arbitrary file within a web-accessible directory. Once uploaded, the attacker can request the file directly to trigger execution under the web server context. The result is remote code execution on the underlying host.

The issue is classified under [CWE-434], Unrestricted Upload of File with Dangerous Type. The EPSS probability sits at 0.83%, reflecting limited exploitation likelihood in the near term but non-trivial given the direct path to code execution.

Root Cause

The root cause is missing file type validation in the save_options handler. The function accepts uploaded content without verifying MIME type, extension, or file signature. WordPress's built-in wp_check_filetype_and_ext and wp_handle_upload safeguards are bypassed because the plugin implements its own upload logic without applying equivalent controls.

Attack Vector

Exploitation requires an authenticated session with Administrator privileges. The attacker sends a POST request to the plugin's settings endpoint containing a malicious file, such as a PHP webshell disguised as a configuration asset. Since no server-side validation is performed, the file is written to disk in a location reachable over HTTP. The attacker then issues a follow-up request to the uploaded file to execute arbitrary code. Review the WordPress Plugin Code File for the vulnerable implementation and the WordPress Changeset History for the applied fix.

Detection Methods for CVE-2024-13908

Indicators of Compromise

Unexpected files with .php, .phtml, or other executable extensions appearing under the plugin's upload or configuration directories
Web server access logs showing POST requests to the SMTP plugin settings page followed by GETs to newly created files
Administrator account activity from unusual IP addresses immediately preceding new file creation on disk
Modifications to class-bwssmtp-settings.php handling logic outside of official plugin updates

Detection Strategies

Monitor filesystem changes within wp-content/plugins/bws-smtp/ and adjacent upload paths for new script files
Correlate WordPress audit logs of plugin setting changes with subsequent HTTP requests to non-standard filenames
Deploy file integrity monitoring on the WordPress webroot to alert on writes of executable content
Inspect outbound network connections from the WordPress PHP process for signs of reverse shells or command-and-control traffic

Monitoring Recommendations

Enable verbose logging on the WordPress administrative interface and forward events to a centralized SIEM
Alert on any POST request to admin.php?page=bws-smtp.php (or equivalent) that includes a multipart file payload
Track privilege changes and new Administrator account creation as leading indicators of pre-exploitation activity
Review PHP error logs for execution of files residing outside expected script paths

How to Mitigate CVE-2024-13908

Immediate Actions Required

Update the SMTP by BestWebSoft plugin to the version released in changeset 3250935 or later, which supersedes vulnerable release 1.1.9
Audit all Administrator accounts and rotate credentials, prioritizing accounts with recent plugin configuration activity
Enforce multi-factor authentication for every WordPress account holding Administrator privileges
Scan the WordPress filesystem for unauthorized .php files and remove any that cannot be attributed to a known plugin or theme

Patch Information

The vendor addressed the vulnerability in the WordPress plugin repository. The fix is available in the changeset published at WordPress Changeset History. Site administrators should install the update through the WordPress plugin management interface or replace the plugin files directly from the official source. Additional advisory context is available in the Wordfence Vulnerability Report.

Workarounds

Deactivate and remove the SMTP by BestWebSoft plugin until patching is complete
Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer to limit exposure of the vulnerable settings endpoint
Configure the web server to deny PHP execution within plugin upload directories using directives such as php_flag engine off in a scoped .htaccess file
Apply a web application firewall rule that blocks multipart uploads to the SMTP plugin settings handler containing script extensions

bash

# Configuration example: disable PHP execution in plugin upload paths (Apache)
<Directory "/var/www/html/wp-content/plugins/bws-smtp">
    <FilesMatch "\.(php|phtml|php5|phar)$">
        Require all denied
    </FilesMatch>
</Directory>