CVE-2024-35767 Overview
CVE-2024-35767 is an unrestricted file upload vulnerability in the Bogdan Bendziukov Squeeze plugin for WordPress. The flaw affects all plugin versions from n/a through 1.4 and enables code injection through arbitrary file upload. An authenticated attacker with high privileges can upload files of dangerous types, including PHP scripts, and execute code in the WordPress runtime context. The weakness maps to CWE-434: Unrestricted Upload of File with Dangerous Type.
Critical Impact
Successful exploitation grants attackers code execution on the WordPress host, leading to full site compromise, data theft, and persistence via web shells.
Affected Products
- Bogdan Bendziukov Squeeze WordPress plugin versions up to and including 1.4
- WordPress sites with the Squeeze plugin installed and activated
- All hosting environments running the vulnerable plugin build
Discovery Timeline
- 2024-06-21 - CVE-2024-35767 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-35767
Vulnerability Analysis
The Squeeze plugin exposes a file upload handler that fails to validate uploaded file types. An attacker sends a crafted multipart request containing an executable file, such as a PHP script disguised or delivered directly. Because the handler does not enforce a safe MIME allowlist or extension check, the file lands in a web-accessible directory. The attacker then requests the uploaded file via HTTP to trigger server-side execution. The exploit path requires network access and authenticated high-privilege context, yet delivers confidentiality, integrity, and availability impact across the WordPress instance.
Root Cause
The root cause is missing or improper validation of user-supplied file content and extension in the plugin's upload routine. The code accepts arbitrary uploads without enforcing a deny list for executable extensions like .php, .phtml, or .phar. It also fails to sanitize filenames and store uploads outside the web root, so uploaded content remains directly reachable by unauthenticated HTTP requests.
Attack Vector
Exploitation occurs over the network against the WordPress admin interface exposed by the plugin. The attacker authenticates with a privileged account, then submits a POST request to the vulnerable upload endpoint with a PHP payload. Once the file is stored under wp-content/uploads/ or a plugin-specific directory, the attacker issues a GET request to the uploaded path. The web server hands execution to the PHP interpreter, running arbitrary code as the WordPress user.
Refer to the Patchstack Vulnerability Report for advisory details.
Detection Methods for CVE-2024-35767
Indicators of Compromise
- New PHP files appearing in wp-content/uploads/ or Squeeze plugin directories with recent modification timestamps.
- HTTP POST requests to Squeeze plugin upload endpoints followed by GET requests to newly created .php files.
- Unexpected outbound connections from the web server process to attacker-controlled infrastructure.
- WordPress administrator sessions originating from unusual IP addresses or geographies prior to upload activity.
Detection Strategies
- Inventory WordPress installations and flag any host running Squeeze plugin versions <= 1.4.
- Alert on file creation events where the parent process is the web server user and the file extension is executable (.php, .phtml, .phar).
- Correlate WordPress access logs to identify POST-to-GET request patterns targeting user-writable directories.
Monitoring Recommendations
- Enable file integrity monitoring across wp-content/uploads/ and all active plugin directories.
- Ship WordPress and web server logs to a centralized analytics platform for behavioral correlation.
- Track privileged WordPress account logins and audit new administrator or editor accounts daily.
How to Mitigate CVE-2024-35767
Immediate Actions Required
- Update the Squeeze plugin to a version later than 1.4 once a vendor-supplied fix is available; consult the Patchstack Vulnerability Report for status.
- Deactivate and remove the Squeeze plugin if a patched release is not yet available.
- Audit wp-content/uploads/ and plugin directories for unauthorized PHP files and remove them.
- Rotate credentials for all WordPress accounts with upload_files or higher capabilities.
Patch Information
At the time of writing, the Patchstack advisory lists the vulnerability as affecting versions up to 1.4. Administrators should monitor the plugin listing on WordPress.org and Patchstack for a fixed release, then apply it across all managed WordPress sites.
Workarounds
- Block execution of PHP files inside wp-content/uploads/ by configuring the web server (for example, using an .htaccess deny rule or an Nginx location directive).
- Restrict access to plugin upload endpoints via a web application firewall rule that inspects file extensions in multipart uploads.
- Enforce least privilege by reducing the number of accounts with administrative or editor roles on the WordPress site.
# Apache: block PHP execution inside the uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|php8)$">
Require all denied
</FilesMatch>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
