CVE-2024-2381 Overview
CVE-2024-2381 is an arbitrary file upload vulnerability in the AliExpress Dropshipping with AliNext Lite plugin for WordPress. The flaw resides in the ajax_save_image function, which lacks file type validation. All plugin versions up to and including 3.3.5 are affected. Authenticated attackers with subscriber-level access or higher can upload arbitrary files to the affected server, potentially leading to remote code execution. The vulnerability is classified as [CWE-434] Unrestricted Upload of File with Dangerous Type.
Critical Impact
Authenticated attackers with minimal subscriber privileges can upload arbitrary files, enabling remote code execution and full site compromise on affected WordPress installations.
Affected Products
- Ali2woo AliExpress Dropshipping with AliNext Lite plugin for WordPress
- All versions up to and including 3.3.5
- WordPress sites with subscriber registration enabled are at highest risk
Discovery Timeline
- 2024-06-19 - CVE-2024-2381 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-2381
Vulnerability Analysis
The vulnerability exists in the ajax_save_image function within WooCommerceProductEditController.php. The function accepts image save requests via AJAX but fails to validate the MIME type or extension of the uploaded file. Because the endpoint is exposed to any authenticated user, an attacker holding only a subscriber account can invoke it directly. The plugin writes the supplied file to a web-accessible location without enforcing an allowlist of safe types. This gap allows PHP scripts, web shells, or other executable payloads to reach the server filesystem.
Root Cause
The root cause is missing file type validation in ajax_save_image. The handler trusts client-supplied filename and content data instead of verifying the file against a strict allowlist of image MIME types. It also fails to enforce a capability check appropriate for administrative image uploads, granting subscriber-level roles access to functionality intended for store operators. The upstream fix, tracked in WordPress Plugin Change Log, introduces validation on the uploaded file.
Attack Vector
An attacker registers or compromises a subscriber account on the target WordPress site. The attacker then sends an authenticated AJAX request to the vulnerable ajax_save_image action, supplying a PHP file disguised as an image. The plugin writes the file to the WordPress uploads directory. The attacker then requests the uploaded PHP file directly, triggering execution under the web server user and achieving remote code execution. See the WordPress Plugin Code Review and Wordfence Vulnerability Report for technical details.
Detection Methods for CVE-2024-2381
Indicators of Compromise
- Unexpected .php, .phtml, or .phar files appearing in wp-content/uploads/ or plugin-specific upload directories
- POST requests to admin-ajax.php referencing the ajax_save_image action from low-privilege user sessions
- New administrator accounts, modified WordPress core files, or scheduled tasks created shortly after upload activity
- Outbound connections from the web server to attacker-controlled infrastructure following upload events
Detection Strategies
- Inspect web server access logs for authenticated requests to admin-ajax.php with the ajax_save_image action originating from subscriber accounts
- Monitor the WordPress uploads directory for newly written files whose extensions do not match declared image MIME types
- Deploy web application firewall rules that block executable file extensions in multipart uploads targeting the vulnerable endpoint
Monitoring Recommendations
- Enable file integrity monitoring on WordPress content directories and alert on the creation of scripts within upload paths
- Correlate WordPress user registration events with subsequent upload activity to identify opportunistic account abuse
- Track process execution from the web server user for php interpreter spawns tied to files under wp-content/uploads/
How to Mitigate CVE-2024-2381
Immediate Actions Required
- Update the AliExpress Dropshipping with AliNext Lite plugin to a version later than 3.3.5 that includes the changeset 3107543 fix
- Audit WordPress user accounts and disable open subscriber registration if it is not required for site operations
- Scan wp-content/uploads/ for unauthorized PHP or executable files and remove any that are not part of legitimate media assets
- Rotate WordPress administrator credentials and API keys if evidence of exploitation is found
Patch Information
The vendor addressed the missing file type validation in the WordPress Plugin Change Log commit. Site administrators should upgrade to the patched release beyond version 3.3.5 through the WordPress plugin manager. Confirm the patched version is active by reviewing the plugin metadata after update.
Workarounds
- Deactivate and remove the AliExpress Dropshipping with AliNext Lite plugin until an updated version can be installed
- Restrict PHP execution within the wp-content/uploads/ directory using web server configuration to prevent uploaded scripts from running
- Enforce least-privilege by removing unused subscriber accounts and requiring strong authentication for any remaining low-privilege roles
# Block PHP execution in WordPress uploads directory (Apache .htaccess)
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|phps)$">
Require all denied
</FilesMatch>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
