CVE-2024-25909: WP Media Folder File Upload Vulnerability

CVE-2024-25909 Overview

CVE-2024-25909 is an arbitrary file upload vulnerability in the JoomUnited WP Media Folder plugin for WordPress. The flaw affects all versions up to and including 5.7.2 and is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type. An authenticated attacker with Subscriber-level privileges can upload files of dangerous types to the target site. Successful exploitation can lead to remote code execution on the underlying WordPress host.

Critical Impact
A low-privileged Subscriber account can upload arbitrary files, enabling code execution and full compromise of the WordPress site.

Affected Products

JoomUnited WP Media Folder plugin for WordPress
All versions from n/a through 5.7.2
WordPress sites running the vulnerable plugin with open user registration

Discovery Timeline

2024-02-26 - CVE-2024-25909 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25909

Vulnerability Analysis

The WP Media Folder plugin exposes a file upload endpoint that does not adequately restrict the types of files that authenticated users can submit. The plugin fails to enforce a strict allow-list of MIME types or file extensions before writing uploaded content to disk. An attacker authenticated as a WordPress Subscriber, which is the lowest privileged role, can abuse the endpoint to upload executable content such as PHP scripts.

Once written to a web-accessible directory, the attacker can request the uploaded file directly. The web server then executes the attacker-controlled code in the context of the PHP worker process. This gives the attacker code execution equivalent to the WordPress process user and access to the site database via wp-config.php.

The issue is reachable over the network without user interaction beyond the initial low-privilege authentication. Given that many WordPress sites allow open Subscriber registration, the attacker prerequisite is often trivial to satisfy. According to Patchstack, the vulnerability is classified as an arbitrary file upload issue exploitable by Subscribers. The EPSS probability score is 0.643%.

Root Cause

The root cause is missing or insufficient validation of uploaded file types in the plugin's media handling routines. The plugin trusts client-supplied file metadata and does not reject dangerous extensions such as .php, .phtml, or .phar before persisting the file. This is a classic [CWE-434] weakness.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker registers or compromises a Subscriber account on the target WordPress site. The attacker then issues an authenticated HTTP POST request to the vulnerable upload endpoint exposed by WP Media Folder, submitting a PHP payload disguised or declared as an allowed media type. After the plugin stores the file within the WordPress uploads directory, the attacker retrieves it via a direct HTTP request to trigger execution. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-25909

Indicators of Compromise

New files with executable extensions such as .php, .phtml, .phar, or .htaccess appearing under wp-content/uploads/ or the WP Media Folder directory tree
HTTP POST requests to WP Media Folder AJAX endpoints originating from Subscriber-level accounts
Outbound network connections from the PHP-FPM or Apache worker process to unknown external hosts shortly after upload activity
Newly created WordPress administrator accounts that follow upload activity from low-privileged users

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php or plugin routes referencing wpmf actions from non-admin users
Scan the uploads directory for files whose extensions do not match their declared MIME type or that contain PHP tags like <?php
Correlate WordPress audit logs of new user registrations with subsequent file upload events

Monitoring Recommendations

Enable file integrity monitoring on the WordPress wp-content/uploads/ directory and alert on creation of scripting extensions
Forward web server and WordPress application logs to a centralized log platform for retention and query
Monitor for anomalous process execution originating from the web server user, such as spawned shells or curl and wget invocations

How to Mitigate CVE-2024-25909

Immediate Actions Required

Upgrade the WP Media Folder plugin to a version later than 5.7.2 as published by JoomUnited
Audit existing WordPress accounts and remove untrusted Subscriber-level users
Disable open user registration on WordPress sites that do not require it by unchecking Settings → General → Membership
Review wp-content/uploads/ for any suspicious files created before the patch was applied and remove them

Patch Information

JoomUnited has addressed the arbitrary file upload issue in WP Media Folder releases after 5.7.2. Administrators should apply the latest available plugin version through the WordPress admin dashboard or by replacing the plugin files. Verify remediation by consulting the Patchstack Vulnerability Report.

Workarounds

Restrict access to the plugin's upload endpoints using a Web Application Firewall (WAF) rule that blocks non-administrator requests
Deny execution of PHP files within the wp-content/uploads/ directory using web server configuration
Temporarily deactivate the WP Media Folder plugin until the patched version is deployed

bash

# Apache: deny PHP execution inside the uploads directory
# Place this in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7)$">
    Require all denied
</FilesMatch>

# Nginx: add to the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}