CVE-2024-49331: Property Lot Management System RCE Vulnerability

CVE-2024-49331 Overview

CVE-2024-49331 is an unrestricted file upload vulnerability in the Myriad Solutionz Property Lot Management System (PLMS) WordPress plugin. The flaw affects all versions from initial release through 4.2.38. Authenticated attackers with low-privilege access can upload files of dangerous types, including web shells, directly to the web server. Successful exploitation grants arbitrary code execution in the WordPress hosting context. The vulnerability is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers can upload web shells to achieve remote code execution, leading to full compromise of the WordPress site and underlying web server.

Affected Products

Myriad Solutionz Property Lot Management System (PLMS) WordPress plugin — all versions up to and including 4.2.38
WordPress deployments running the vulnerable plms plugin
Web servers hosting sites with the plugin enabled

Discovery Timeline

2024-10-20 - CVE-2024-49331 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49331

Vulnerability Analysis

The Property Lot Management System plugin exposes a file upload handler that fails to validate uploaded file types against a strict allowlist. Attackers submit files with executable extensions such as .php, .phtml, or .phar, and the plugin writes them to a web-accessible directory. Once uploaded, the attacker requests the file through the browser to trigger server-side execution.

The vulnerability requires low-privilege authentication but no user interaction. After execution, an attacker inherits the privileges of the PHP worker process, enabling database access, credential theft, lateral movement, and persistent backdoor installation. The EPSS score sits at 0.492% with a percentile of 40.026, indicating moderate exploitation likelihood relative to other public CVEs.

Root Cause

The root cause is missing or insufficient server-side validation of file uploads. The plugin does not verify MIME type, file extension, and magic bytes together, nor does it rename uploaded files to non-executable extensions. It also fails to store uploads outside the web root or in a directory where PHP execution is disabled.

Attack Vector

An attacker with a low-privilege authenticated session sends a crafted multipart HTTP POST request to the vulnerable upload endpoint. The request includes a PHP web shell disguised or presented with an executable extension. The plugin writes the file to a predictable path under wp-content/. The attacker then issues a GET request to the uploaded file, causing the web server to execute the embedded PHP code.

No verified proof-of-concept code is publicly available. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2024-49331

Indicators of Compromise

New or unexpected .php, .phtml, .phar, or .pht files inside wp-content/uploads/ or plugin-managed upload directories
HTTP POST requests to PLMS plugin upload endpoints from authenticated low-privilege user accounts
Outbound connections from the web server to unfamiliar IPs shortly after upload activity
WordPress user accounts created or elevated without administrator action

Detection Strategies

Inspect web server access logs for POST requests to PLMS plugin endpoints followed by GET requests to newly created files under upload directories
Deploy file integrity monitoring on wp-content/uploads/ to alert on creation of files with executable extensions
Correlate WordPress authentication events with subsequent file creation and PHP execution activity

Monitoring Recommendations

Forward web server, PHP-FPM, and WordPress audit logs to a centralized log platform for retention and analytics
Alert on execution of PHP processes spawning shell interpreters such as /bin/sh, bash, or python
Baseline outbound network traffic from the web server and alert on deviations that indicate reverse shells or data exfiltration

How to Mitigate CVE-2024-49331

Immediate Actions Required

Disable or deactivate the Property Lot Management System plugin until a patched version is confirmed installed
Audit wp-content/uploads/ and adjacent directories for unauthorized PHP files and remove any web shells discovered
Rotate WordPress administrator, editor, and database credentials if compromise is suspected
Review WordPress user accounts and remove unauthorized users or role escalations

Patch Information

At the time of publication, no fixed version beyond 4.2.38 is referenced in the NVD entry. Monitor the Patchstack advisory and the vendor's plugin page for an official patched release, and apply updates immediately upon availability.

Workarounds

Deactivate the plugin from the WordPress administration panel until a vendor patch is released
Configure the web server to deny PHP execution inside wp-content/uploads/ using directives such as Apache <FilesMatch> blocks or Nginx location rules
Restrict access to the plugin's upload endpoints via a web application firewall (WAF) rule that blocks requests containing executable file extensions
Enforce least-privilege on WordPress accounts and remove unnecessary users who could exploit the authenticated upload path

bash

# Nginx: block PHP execution inside the WordPress uploads directory
location ~* /wp-content/uploads/.*\.(php|phtml|phar|pht)$ {
    deny all;
    return 403;
}