CVE-2024-30231: WebToffee WooCommerce Import Export RCE Flaw

CVE-2024-30231 Overview

CVE-2024-30231 is an unrestricted file upload vulnerability in the WebToffee Product Import Export for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 2.4.1. An authenticated attacker with high privileges can upload files of dangerous types to a vulnerable site. Successful exploitation impacts confidentiality, integrity, and availability of the underlying host. The issue is categorized under [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
An authenticated attacker can upload arbitrary files, including executable PHP payloads, leading to remote code execution on the WordPress server hosting the affected plugin.

Affected Products

WebToffee Product Import Export for WooCommerce plugin for WordPress
All versions from initial release through 2.4.1
WordPress installations using the WooCommerce ecosystem with this plugin active

Discovery Timeline

2024-03-26 - CVE-2024-30231 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30231

Vulnerability Analysis

The vulnerability resides in the file upload handling logic of the Product Import Export for WooCommerce plugin. The plugin fails to properly validate the type of files supplied during import operations. An attacker with high-privileged access can submit files whose extensions or MIME types would normally be blocked. Because the plugin accepts these files without sufficient restriction, dangerous content such as PHP scripts can be written to a location on the web server. Once written, the uploaded file can be requested over HTTP to execute attacker-controlled code in the context of the web server user.

Root Cause

The root cause is missing or insufficient server-side validation of the file extension, MIME type, and content of files supplied to the plugin's import workflows. The plugin trusts input associated with the import process instead of enforcing an allow-list of safe file types. This class of defect is tracked as [CWE-434] Unrestricted Upload of File with Dangerous Type.

Attack Vector

The attack is delivered over the network against the WordPress administration surface. Exploitation requires an authenticated session with high privileges, such as an administrator or an equivalent role that can access the plugin's import functionality. No user interaction is required beyond the attacker's own authenticated request. After uploading a script file, the attacker triggers execution by requesting the resulting URL, obtaining code execution on the server.

No verified public proof-of-concept code is available. See the Patchstack Advisory: WooCommerce File Upload Vulnerability for the technical write-up.

Detection Methods for CVE-2024-30231

Indicators of Compromise

Presence of unexpected .php, .phtml, or other executable script files under the WordPress wp-content/uploads/ directory or plugin-specific import directories.
Access log entries showing POST requests to plugin import endpoints followed by GET requests to newly created files with script extensions.
New administrator accounts, modified theme files, or scheduled tasks created shortly after import activity by a privileged user.

Detection Strategies

Audit installed plugin versions across WordPress fleets and flag any instance of Product Import Export for WooCommerce at version 2.4.1 or earlier.
Inspect web server access logs for anomalous file uploads via the plugin's import handlers, particularly outside expected maintenance windows.
File integrity monitoring on wp-content/ to detect creation of files with executable extensions in upload directories.

Monitoring Recommendations

Alert on process creation from the web server user spawning shells, curl, wget, or scripting interpreters.
Correlate WordPress admin authentication events with subsequent file creation activity in upload paths.
Forward web server, PHP-FPM, and WordPress audit logs to a centralized analytics platform for retention and threat hunting.

How to Mitigate CVE-2024-30231

Immediate Actions Required

Update the Product Import Export for WooCommerce plugin to a version later than 2.4.1 on all affected WordPress sites.
Review WordPress administrator accounts, disable unused privileged users, and rotate credentials for any account that could reach the vulnerable import functionality.
Search web root directories for unauthorized script files created since the plugin was first installed.

Patch Information

The vendor has released fixes in versions after 2.4.1. Administrators should upgrade to the latest release available from the WordPress plugin repository or the WebToffee vendor site. Refer to the Patchstack Advisory: WooCommerce File Upload Vulnerability for authoritative fixed-version guidance.

Workarounds

If immediate patching is not possible, deactivate the Product Import Export for WooCommerce plugin until it can be updated.
Restrict access to the WordPress admin interface using IP allow-lists, VPN gating, or a web application firewall rule set covering file upload endpoints.
Configure the web server to deny execution of PHP files inside wp-content/uploads/ and other writable directories through Options -ExecCGI or equivalent controls.

bash

# Example Apache configuration to prevent PHP execution in uploads
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>