CVE-2024-30500: CubeWP Unrestricted File Upload Vulnerability

CVE-2024-30500 Overview

CVE-2024-30500 is an arbitrary file upload vulnerability in the CubeWP – All-in-One Dynamic Content Framework plugin for WordPress. The flaw affects all versions up to and including 1.1.12. Authenticated attackers with low privileges can upload files of dangerous types, leading to remote code execution on the underlying web server. The weakness is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
A network-reachable, low-privileged attacker can upload executable files to a WordPress site running a vulnerable CubeWP plugin, achieving code execution and full compromise of confidentiality, integrity, and availability.

Affected Products

CubeWP – All-in-One Dynamic Content Framework plugin for WordPress
All versions from n/a through 1.1.12
WordPress sites with the CubeWP framework installed and active

Discovery Timeline

2024-03-29 - CVE-2024-30500 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30500

Vulnerability Analysis

The vulnerability stems from missing validation of file types on an upload handler exposed by the CubeWP framework. The plugin accepts user-supplied files without adequately restricting server-side executable extensions or verifying MIME types against an allowlist. An attacker holding a low-privileged account can invoke the upload endpoint over the network and place a PHP file within the WordPress uploads directory.

Once the file lands in a web-accessible path, the attacker requests it directly. The web server executes the file as PHP, granting the attacker code execution in the context of the WordPress process. From that position, an attacker can pivot to database credentials in wp-config.php, plant persistent web shells, and move laterally.

The attack requires network access and a single set of low-privileged credentials. No user interaction is required, and exploitation impacts confidentiality, integrity, and availability. The EPSS probability of 0.643% reflects predicted exploitation activity relative to other public CVEs.

Root Cause

The root cause is improper input validation on the file upload handler. The CubeWP plugin fails to enforce a strict extension allowlist and does not sanity-check uploaded content against permitted MIME types before writing the file to disk within the WordPress content directory.

Attack Vector

Exploitation proceeds over HTTP or HTTPS against the WordPress site. The attacker authenticates as a low-privileged user, submits a crafted multipart upload containing a PHP payload with a bypass extension, then requests the resulting URL from the uploads directory to trigger execution. See the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-30500

Indicators of Compromise

New PHP, .phtml, or .phar files appearing under wp-content/uploads/ where only media files are expected.
HTTP POST requests to CubeWP upload endpoints followed by direct GET requests to newly created files in the uploads path.
Unexpected outbound network connections initiated by the PHP-FPM or web server process.
WordPress user sessions performing uploads from IP addresses that do not match historical patterns for that account.

Detection Strategies

Alert on any executable script file written into WordPress uploads directories via file-integrity monitoring.
Correlate authenticated upload activity with subsequent requests that execute files from the uploads path.
Inspect web server access logs for POST requests to CubeWP AJAX or REST endpoints followed by GET requests to files with double extensions such as image.php.jpg.

Monitoring Recommendations

Enable verbose logging of WordPress plugin activity and forward logs to a centralized analytics platform.
Track child process creation from the web server user account and flag interpreters spawning shells.
Baseline the content of wp-content/uploads/ and alert on any file type deviation.

How to Mitigate CVE-2024-30500

Immediate Actions Required

Update the CubeWP – All-in-One Dynamic Content Framework plugin to a version later than 1.1.12 as soon as the vendor patch is available.
Audit wp-content/uploads/ for unexpected PHP or script files and remove any confirmed web shells.
Rotate WordPress administrator passwords, API keys, and database credentials if compromise is suspected.
Review user accounts and revoke any low-privileged accounts created without authorization.

Patch Information

Refer to the Patchstack Vulnerability Report for vendor patch status and fixed version guidance. Apply the vendor-supplied update through the WordPress plugin management interface once released.

Workarounds

Deactivate the CubeWP plugin until a patched version is installed if immediate updating is not feasible.
Deploy a web application firewall rule that blocks upload requests containing PHP or other server-executable extensions.
Configure the web server to deny execution of PHP files within wp-content/uploads/ using directory-level rules.

bash

# Apache: prevent PHP execution inside the WordPress uploads directory
# Place this in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
    Require all denied
</FilesMatch>