CVE-2024-27964: Zippy Unrestricted File Upload Vulnerability

CVE-2024-27964 Overview

CVE-2024-27964 is an unrestricted file upload vulnerability affecting the Zippy WordPress plugin developed by Gesundheit Bewegt GmbH. The flaw affects all versions from initial release through 1.6.9. Authenticated attackers with low privileges can upload files of dangerous types to vulnerable WordPress installations. Successful exploitation grants attackers the ability to execute arbitrary code on the underlying web server. The vulnerability is tracked under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Authenticated attackers can upload malicious files that execute as server-side code, leading to full site compromise, data theft, and lateral movement within the hosting environment.

Affected Products

Gesundheit Bewegt GmbH Zippy WordPress plugin versions up to and including 1.6.9
WordPress sites running the vulnerable Zippy plugin
Hosting environments with PHP execution enabled in upload directories

Discovery Timeline

2024-03-21 - CVE-2024-27964 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27964

Vulnerability Analysis

The Zippy plugin fails to validate the type and extension of files submitted through its upload functionality. The plugin accepts arbitrary file types without enforcing an allow-list of safe extensions or verifying MIME content. An attacker with low-level authenticated access can submit a PHP file or other executable server-side script. Once uploaded to a web-accessible directory, the attacker requests the file directly through the browser to trigger execution.

Exploitation results in arbitrary code execution in the context of the web server user. This provides a path to database compromise, credential theft, webshell persistence, and pivoting into adjacent WordPress sites on shared hosting.

Root Cause

The root cause is missing or insufficient validation logic in the plugin's file upload handler. The plugin does not enforce restrictions on file extensions, MIME types, or file content signatures. WordPress plugins that rely solely on client-supplied metadata for file classification remain vulnerable to this class of flaw, classified as CWE-434.

Attack Vector

The attack requires network access to the WordPress site and authenticated access at any privilege level that can reach the vulnerable upload endpoint. No user interaction is required. An attacker submits a crafted multipart HTTP POST request containing a PHP payload with a .php extension or a double extension such as .jpg.php. After upload, the attacker retrieves the file URL and executes the payload by requesting it through the browser. Refer to the Patchstack Vulnerability Database Entry for additional technical context.

Detection Methods for CVE-2024-27964

Indicators of Compromise

Unexpected PHP, .phtml, or .phar files in wp-content/uploads/ directories, particularly in Zippy plugin subdirectories
Outbound network connections from the web server process to unfamiliar IP addresses following upload activity
New or modified WordPress administrator accounts created shortly after suspicious upload requests
Access log entries showing direct requests to uploaded files with server-side script extensions

Detection Strategies

Review web server access logs for POST requests to Zippy plugin endpoints followed by GET requests to newly created files in the uploads directory
Scan the WordPress filesystem for PHP files placed outside expected plugin and theme directories
Correlate authenticated user actions with file creation timestamps to identify suspicious upload patterns

Monitoring Recommendations

Enable file integrity monitoring on all WordPress upload directories and alert on creation of executable file types
Log and inspect all HTTP requests to admin-ajax.php and Zippy plugin routes for unusual multipart payloads
Monitor web server process spawns for shell interpreters such as sh, bash, or python originating from PHP processes

How to Mitigate CVE-2024-27964

Immediate Actions Required

Update the Zippy plugin to a version later than 1.6.9 once the vendor releases a patched release
If no patched version is available, deactivate and remove the Zippy plugin from all affected WordPress installations
Audit the WordPress uploads directory for unauthorized files and remove any webshells or unexpected scripts
Rotate WordPress administrator credentials and API keys if compromise is suspected

Patch Information

At the time of publication, users should consult the Patchstack Vulnerability Database Entry for current patch availability and vendor guidance. Apply the fixed version immediately upon release.

Workarounds

Restrict access to WordPress upload endpoints using web application firewall rules that block requests containing dangerous file extensions
Configure the web server to deny PHP execution within the wp-content/uploads/ directory using directives such as php_flag engine off in .htaccess or an equivalent Nginx location block
Limit plugin usage to trusted, authenticated administrators and remove low-privilege access to upload functionality where possible

bash

# Apache .htaccess block to prevent PHP execution in uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|pht)$">
        Require all denied
    </FilesMatch>
    php_flag engine off
</Directory>