CVE-2024-37109: Wishlist Member Code Injection RCE Flaw

CVE-2024-37109 Overview

CVE-2024-37109 is a code injection vulnerability affecting the WishList Member X membership plugin for WordPress. The flaw allows authenticated attackers to execute arbitrary PHP code on affected WordPress installations. The vulnerability is categorized under [CWE-94] Improper Control of Generation of Code. It impacts all versions of WishList Member X prior to 3.26.7. Successful exploitation grants attackers full compromise of the web application, including confidentiality, integrity, and availability of the underlying site.

Critical Impact
Authenticated attackers can execute arbitrary PHP code on the WordPress server, resulting in complete site compromise and potential lateral movement into the hosting environment.

Affected Products

WishList Member X plugin for WordPress, all versions before 3.26.7
WordPress sites running the Membership Software WishList Member X extension
Hosting environments serving vulnerable WishList Member X installations

Discovery Timeline

2024-06-24 - CVE-2024-37109 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37109

Vulnerability Analysis

The vulnerability resides in the WishList Member X plugin, a commercial membership management extension for WordPress. According to the Patchstack advisory, the flaw permits authenticated arbitrary PHP code execution. An attacker with low-privilege authenticated access to a target site can supply crafted input that the plugin passes into a code-generation or evaluation routine. The plugin then executes the attacker-supplied PHP within the WordPress process. This yields code execution under the privileges of the web server user, allowing modification of site content, database access, and pivoting to other hosted assets.

Root Cause

The root cause is improper control of code generation, classified as [CWE-94]. The plugin accepts user-controllable input and incorporates it into a PHP execution context without sufficient validation, sanitization, or safe evaluation boundaries. Functions such as eval(), create_function(), assert(), or dynamic include/require patterns commonly underlie CWE-94 defects in PHP applications. The vendor addressed the defect in version 3.26.7.

Attack Vector

Exploitation occurs over the network against the WordPress HTTP interface. The attacker must hold valid authenticated credentials on the target site, but no user interaction is required beyond the attacker's own request. Once authenticated, the attacker sends a crafted request to a vulnerable plugin endpoint carrying PHP payload data. The plugin then evaluates that data as code. Because WordPress plugin code runs with the privileges of the PHP-FPM or web server process, an attacker can drop web shells, exfiltrate database credentials from wp-config.php, and establish persistence.

No verified public proof-of-concept code is available for this CVE. Refer to the Patchstack Vulnerability Database Entry for the vendor-coordinated advisory.

Detection Methods for CVE-2024-37109

Indicators of Compromise

Unexpected PHP files appearing in the WordPress wp-content/uploads/ or plugin directories, particularly files with obfuscated content or short randomized filenames.
WordPress database entries in wp_options or wp_usermeta containing serialized PHP code or base64-encoded payloads associated with WishList Member X operations.
Outbound network connections from the web server to unfamiliar hosts shortly after authenticated requests to WishList Member X endpoints.
New or modified administrator accounts, cron jobs, or scheduled WordPress tasks created without change-control records.

Detection Strategies

Review web server access logs for authenticated POST requests to WishList Member X plugin endpoints containing PHP tokens such as <?php, eval(, system(, or base64_decode( in parameters.
Deploy file integrity monitoring on the WordPress installation directory to detect creation of unexpected .php files.
Correlate WordPress authentication events with subsequent requests to plugin endpoints to identify low-privilege accounts probing membership functionality.

Monitoring Recommendations

Enable verbose PHP error and access logging on the WordPress host and forward logs to a centralized analytics platform.
Monitor for child processes spawned by the web server user, including sh, bash, curl, wget, or python, which indicate post-exploitation activity.
Alert on modifications to wp-config.php, .htaccess, and plugin PHP files outside of scheduled maintenance windows.

How to Mitigate CVE-2024-37109

Immediate Actions Required

Upgrade WishList Member X to version 3.26.7 or later on all affected WordPress sites.
Audit all WordPress user accounts and remove or rotate credentials for accounts that are unused or unrecognized.
Inspect the WordPress installation for web shells, unauthorized administrator accounts, and modified plugin files following the upgrade.
Rotate WordPress secrets in wp-config.php (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY) and database credentials if compromise is suspected.

Patch Information

The vendor released a fix in WishList Member X version 3.26.7. Site administrators should update the plugin through the WordPress admin interface or by replacing the plugin files with the patched release. Full advisory details are available at the Patchstack Vulnerability Database Entry.

Workarounds

If immediate patching is not feasible, deactivate the WishList Member X plugin until the upgrade can be applied.
Restrict access to WordPress authenticated endpoints with a web application firewall (WAF) rule that blocks requests containing PHP tags or code-execution primitives in parameters.
Enforce strong authentication, including multi-factor authentication for all WordPress accounts, to limit the pool of attackers able to reach the vulnerable code path.

bash

# Disable the vulnerable plugin via WP-CLI until patching is complete
wp plugin deactivate wishlist-member-x

# Update the plugin to the patched version
wp plugin update wishlist-member-x --version=3.26.7

# Verify the installed version
wp plugin get wishlist-member-x --field=version