CVE-2024-22152: WooCommerce Import Export File Upload Flaw

CVE-2024-22152 Overview

CVE-2024-22152 is an unrestricted file upload vulnerability in the WebToffee Product Import Export for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 2.3.7. Authenticated attackers with high privileges can upload files of dangerous types to a vulnerable site. Successful exploitation leads to arbitrary code execution on the underlying web server. The weakness is classified as CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Attackers who reach the plugin's import functionality can upload executable PHP files, achieving full compromise of the WordPress site and its underlying WooCommerce store data.

Affected Products

WebToffee Product Import Export for WooCommerce versions up to and including 2.3.7
WordPress sites running WooCommerce with the vulnerable plugin installed
Deployments that grant plugin-management or shop-manager roles to non-trusted users

Discovery Timeline

2024-01-24 - CVE-2024-22152 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22152

Vulnerability Analysis

The Product Import Export for WooCommerce plugin exposes import handlers that accept uploaded files for product, order, coupon, and customer data ingestion. In versions through 2.3.7, the upload handler does not adequately validate the file extension, MIME type, or content of the uploaded payload. An attacker authenticated with sufficient privileges can submit a file with a dangerous extension, such as .php, and place it inside the WordPress uploads directory. Because WordPress serves files from that directory over HTTP, the attacker can then request the uploaded file and force the server to execute its contents. This results in remote code execution under the web server user context, compromising the entire WordPress instance and any connected database.

Root Cause

The root cause is missing or insufficient allowlist validation on the plugin's import endpoints. The handler accepts arbitrary file types instead of restricting uploads to the expected import formats such as .csv and .xml. No server-side content inspection is performed to confirm that the file matches an expected structure.

Attack Vector

Exploitation requires network access to the WordPress admin interface and an authenticated session with high privileges. The attacker navigates to the plugin's import screen and submits a crafted request containing a PHP payload disguised as, or accompanying, an import file. Once written to disk under wp-content/uploads/, the attacker requests the file directly to trigger execution. The vulnerability is described in detail in the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-22152

Indicators of Compromise

New or unexpected .php, .phtml, or .phar files appearing under wp-content/uploads/ after use of the plugin's import functionality
Outbound network connections from the web server process to unfamiliar hosts following an admin upload event
WordPress admin audit log entries showing import operations from unusual IP addresses or accounts
Web server access logs containing GET requests to attacker-created files inside upload directories

Detection Strategies

Inventory installed WordPress plugins and flag any instance of Product Import Export for WooCommerce at version 2.3.7 or earlier
Monitor file integrity across wp-content/uploads/ and alert on creation of files with executable extensions
Inspect web server logs for POST requests to plugin import endpoints followed by GET requests to newly created files

Monitoring Recommendations

Enable WordPress activity logging to capture import actions and privileged account behavior
Ship web server, PHP-FPM, and WordPress logs to a centralized analytics platform for correlation
Alert on process creation by the web server user that spawns shells, package managers, or network utilities

How to Mitigate CVE-2024-22152

Immediate Actions Required

Update Product Import Export for WooCommerce to a version later than 2.3.7 as soon as a fixed release is available from WebToffee
Audit all administrator and shop-manager accounts and remove unused or over-privileged users
Search wp-content/uploads/ for unauthorized executable files and remove them after preserving forensic copies
Rotate WordPress admin credentials, database passwords, and any API keys stored in wp-config.php if compromise is suspected

Patch Information

Refer to the Patchstack Vulnerability Report for vendor patch status. Administrators should apply the latest release published by WebToffee and confirm the installed version through the WordPress plugin management screen.

Workarounds

Deactivate and remove the plugin until a patched version is installed
Configure the web server to deny execution of PHP files inside wp-content/uploads/ and its subdirectories
Restrict admin dashboard access with IP allowlisting or a web application firewall rule set that blocks unexpected file extensions on import endpoints

bash

# Apache: block PHP execution inside the uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
    Require all denied
</FilesMatch>

# Nginx: add to the server block serving WordPress
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}