CVE-2024-24714: Icons Font Loader File Upload Vulnerability

CVE-2024-24714 Overview

CVE-2024-24714 is an unrestricted file upload vulnerability affecting the bPlugins LLC Icons Font Loader plugin for WordPress. The flaw exists in versions up to and including 1.1.4. An authenticated attacker with high privileges can upload files of dangerous types through the plugin's upload functionality. Successful exploitation leads to arbitrary file upload on the WordPress server, potentially resulting in remote code execution. The weakness is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact
An authenticated attacker can upload dangerous file types to a WordPress site running Icons Font Loader ≤ 1.1.4, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

bPlugins LLC Icons Font Loader plugin for WordPress
Icons Font Loader versions from n/a through 1.1.4
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2024-02-26 - CVE-2024-24714 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24714

Vulnerability Analysis

The Icons Font Loader plugin fails to validate file types during upload operations. The plugin accepts uploaded files without enforcing an allowlist of safe extensions or verifying MIME types against expected font formats. This missing validation permits an attacker to submit executable content such as PHP scripts through the plugin's upload handler.

Exploitation requires authentication with high privileges on the target WordPress instance. The attack vector is network-based and does not require user interaction. Once a malicious file lands in a web-accessible directory, the attacker can request it directly to execute arbitrary code in the context of the web server.

The EPSS score is 0.603% with a percentile of 46.007, reflecting a moderate likelihood of exploitation activity relative to the broader CVE population.

Root Cause

The root cause is insufficient server-side validation of uploaded file content and extensions in the plugin's upload endpoint. The plugin trusts client-supplied metadata rather than verifying that uploaded files match legitimate font formats such as .ttf, .woff, or .woff2. The absence of an extension allowlist and MIME-type verification enables the upload of dangerous file types including PHP scripts.

Attack Vector

An authenticated attacker submits a crafted upload request to the vulnerable Icons Font Loader endpoint. The payload contains a web shell or PHP script disguised as a font file. The plugin writes the file to a directory served by the web server. The attacker then requests the uploaded file, which the PHP interpreter executes, granting the attacker command execution on the underlying host.

No verified public proof-of-concept code is available. Technical details are documented in the Patchstack Vulnerability Database Entry.

Detection Methods for CVE-2024-24714

Indicators of Compromise

Unexpected .php, .phtml, or other executable files in the plugin's upload directories under wp-content/
Web server access logs showing POST requests to Icons Font Loader upload handlers followed by GET requests to newly created files with executable extensions
New administrative or high-privilege user accounts created shortly after suspicious upload activity
Outbound network connections initiated by the PHP worker process to unfamiliar hosts

Detection Strategies

Monitor file system events for creation of executable script files within WordPress plugin and upload directories
Alert on HTTP requests that write files with mismatched extensions or non-font MIME types to Icons Font Loader endpoints
Correlate authenticated administrative sessions with subsequent web shell access patterns

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ and plugin directories
Ingest WordPress audit logs and web server access logs into a centralized analytics platform for correlation
Review authentication logs for unexpected high-privilege account activity preceding upload events

How to Mitigate CVE-2024-24714

Immediate Actions Required

Identify all WordPress sites running Icons Font Loader and confirm the installed version
Deactivate and remove the Icons Font Loader plugin on any installation running version 1.1.4 or earlier until a fixed release is applied
Rotate credentials for all administrative WordPress accounts and enforce multi-factor authentication
Audit wp-content/uploads/ and plugin directories for unauthorized files created since deployment of the plugin

Patch Information

No fixed version is identified in the available CVE data beyond the affected range through 1.1.4. Consult the Patchstack advisory for the latest vendor guidance and updated releases. Apply any newer plugin release published by bPlugins LLC that addresses this issue.

Workarounds

Remove the Icons Font Loader plugin entirely if a patched version is not yet available
Restrict administrative access to WordPress using IP allowlists and enforce least privilege for editor and administrator roles
Configure the web server to deny PHP execution within wp-content/uploads/ and other user-writable directories
Deploy a web application firewall rule that blocks uploads containing PHP tags or non-font MIME types to the plugin's endpoints

bash

# Example nginx configuration to deny PHP execution in uploads directory
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}