CVE-2024-27951: Themeisle MPG Web Shell Upload Vulnerability

CVE-2024-27951 Overview

CVE-2024-27951 is an unrestricted file upload vulnerability in the Themeisle Multiple Page Generator Plugin (MPG) for WordPress. The flaw affects all plugin versions up to and including 3.4.0. Authenticated attackers with high privileges can upload files of dangerous types, including PHP web shells, to the target web server. Successful exploitation leads to remote code execution (RCE) in the WordPress environment. The vulnerability is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Attackers with elevated WordPress privileges can upload a web shell and execute arbitrary code on the underlying server, resulting in full site and host compromise.

Affected Products

Themeisle Multiple Page Generator Plugin (MPG) for WordPress
All versions from n/a through 3.4.0
WordPress installations with the MPG plugin activated

Discovery Timeline

2024-04-03 - CVE-2024-27951 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27951

Vulnerability Analysis

The Multiple Page Generator Plugin allows WordPress administrators to bulk-create pages using data source uploads. The plugin exposes an upload handler that fails to validate the type, extension, and content of uploaded files. As a result, an attacker holding a privileged WordPress role can supply a PHP file disguised as, or uploaded alongside, an expected data file. The plugin writes the file into a web-accessible directory without sanitization or MIME enforcement. Once written, the attacker can request the file directly to trigger PHP execution.

Root Cause

The root cause is missing validation on the server-side upload routine. The plugin does not enforce an allow-list of safe extensions, does not verify file signatures, and does not store uploads outside the web root. This maps directly to CWE-434, where dangerous file types are accepted without restriction.

Attack Vector

Exploitation requires network access to the WordPress admin interface and an authenticated session with high privileges, typically administrator. The attacker submits a crafted upload request through the plugin's page-generation workflow. The payload is a PHP web shell that is placed within the plugin or uploads directory. The attacker then invokes the shell over HTTP to execute operating system commands under the web server user. For further technical detail, see the Patchstack RCE Vulnerability Report.

No public proof-of-concept code has been verified for this advisory, so a sanitized exploit is not reproduced here.

Detection Methods for CVE-2024-27951

Indicators of Compromise

Unexpected .php, .phtml, or .phar files inside wp-content/plugins/multiple-pages-generator-by-porthas/ or wp-content/uploads/ directories.
HTTP POST requests to MPG plugin endpoints containing multipart uploads with executable extensions.
Outbound network connections from the www-data (or equivalent) web server user to unknown hosts following a plugin upload event.
New administrator accounts or modified WordPress options created shortly after MPG upload activity.

Detection Strategies

Monitor filesystem writes to WordPress plugin and uploads directories for files with server-executable extensions.
Inspect web server access logs for POST requests to MPG admin-ajax or REST endpoints followed by direct GET requests to newly created files.
Alert on PHP processes spawning shell interpreters such as sh, bash, or cmd.exe from the web server context.

Monitoring Recommendations

Enable file integrity monitoring across the WordPress webroot with a focus on plugin and uploads paths.
Forward web server, PHP-FPM, and WordPress audit logs to a centralized SIEM for correlation.
Baseline legitimate MPG plugin usage and alert on deviations, particularly non-CSV or non-image file uploads.

How to Mitigate CVE-2024-27951

Immediate Actions Required

Update the Multiple Page Generator Plugin (MPG) to a version later than 3.4.0 that addresses this issue.
Audit administrator accounts and rotate credentials for any account that could reach the MPG upload workflow.
Search the WordPress installation for unexpected PHP files created after the plugin was installed or updated.
If compromise is suspected, isolate the host, preserve logs, and rebuild from a known-good backup.

Patch Information

Refer to the Patchstack RCE Vulnerability Report for fixed-version guidance from Themeisle. Apply the vendor's latest release through the WordPress plugin manager or by replacing the plugin directory with the patched version.

Workarounds

Deactivate and remove the MPG plugin until it can be upgraded to a fixed version.
Restrict access to /wp-admin/ using IP allow-listing or a web application firewall rule.
Deny execution of PHP files inside wp-content/uploads/ using web server configuration.
Enforce least-privilege for WordPress roles to limit which users can reach plugin upload functionality.

bash

# Example: block PHP execution in the WordPress uploads directory (Apache)
# Place this in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
    Require all denied
</FilesMatch>