CVE-2024-22135 Overview
CVE-2024-22135 is an unrestricted file upload vulnerability in the WebToffee Order Export & Order Import for WooCommerce plugin for WordPress. The flaw affects all plugin versions up to and including 2.4.3. The vulnerability is classified under [CWE-434] (Unrestricted Upload of File with Dangerous Type) and allows an authenticated attacker with high privileges to upload arbitrary files to the WordPress server. Successful exploitation can lead to remote code execution on the underlying host.
Critical Impact
An authenticated attacker can upload dangerous file types through the plugin, resulting in arbitrary code execution, full site compromise, and pivoting into the hosting environment.
Affected Products
- WebToffee Order Export & Order Import for WooCommerce versions up to and including 2.4.3
- WordPress sites running the vulnerable plugin
- WooCommerce stores that rely on the plugin for order data import/export
Discovery Timeline
- 2024-01-24 - CVE-2024-22135 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-22135
Vulnerability Analysis
The vulnerability resides in the file upload handling within the Order Export & Order Import for WooCommerce plugin. The plugin accepts user-supplied files during order import operations without properly validating file type, extension, or content. An attacker with sufficient privileges can supply a file with a dangerous extension such as .php or a polyglot file that WordPress or the web server will execute.
Because the plugin operates inside the WordPress administrative context, uploaded files are placed within a directory that is accessible over HTTP. Once uploaded, the attacker requests the file directly to trigger code execution under the web server user. This grants complete control over the WordPress installation and potentially the underlying host.
The attack requires authentication with high privileges according to the CVSS vector, meaning an attacker must first gain access to a privileged account through phishing, credential reuse, or a prior vulnerability chain.
Root Cause
The root cause is missing or insufficient validation on uploaded file types [CWE-434]. The plugin's import routine does not enforce an allowlist of safe extensions, does not verify MIME type against content, and does not rename or sanitize the uploaded file before writing it to a web-accessible directory.
Attack Vector
The attack is network-based. An authenticated user with administrative or equivalent access sends a crafted multipart HTTP request to the plugin's import endpoint. The payload contains a PHP file disguised as an order import file. After upload, the attacker requests the uploaded file via a direct URL to execute the embedded code.
The vulnerability manifests in the import handler of the plugin. See the Patchstack Vulnerability Report for additional technical details.
Detection Methods for CVE-2024-22135
Indicators of Compromise
- Unexpected files with executable extensions such as .php, .phtml, or .phar inside plugin upload directories
- New or modified files in wp-content/uploads/ with recent timestamps that do not match legitimate media uploads
- HTTP POST requests to plugin import endpoints followed by GET requests to newly written files
- Web server processes spawning shells, curl, wget, or database utilities outside normal operation
Detection Strategies
- Monitor WordPress access logs for POST requests to Order Export & Order Import for WooCommerce admin AJAX endpoints
- Audit wp-content/uploads/ recursively for files with server-executable extensions
- Correlate administrator login events with file creation events in plugin-controlled directories
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress installation and plugin directories
- Alert on any new .php file written under wp-content/uploads/ or plugin subdirectories
- Track privileged WordPress user sessions and flag unusual import activity outside business hours
How to Mitigate CVE-2024-22135
Immediate Actions Required
- Update the WebToffee Order Export & Order Import for WooCommerce plugin to a version later than 2.4.3
- Audit administrator and shop manager accounts and rotate credentials for any account with plugin access
- Review wp-content/uploads/ and plugin directories for unauthorized files and remove any malicious artifacts
- Restrict administrative access to the WordPress dashboard using IP allowlisting or a web application firewall
Patch Information
Upgrade to a fixed release of Order Export & Order Import for WooCommerce beyond version 2.4.3. Refer to the Patchstack Vulnerability Report for the vendor's remediation guidance.
Workarounds
- Deactivate the plugin until it can be updated to a patched version
- Deny PHP execution in wp-content/uploads/ via web server configuration to prevent uploaded files from running
- Enforce multi-factor authentication on all high-privilege WordPress accounts to reduce the risk of credential compromise
# Apache: block PHP execution in the WordPress uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar)$">
Require all denied
</FilesMatch>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
