CVE-2024-49610: Jackzhu Photokit RCE Vulnerability

CVE-2024-49610 Overview

CVE-2024-49610 is an Unrestricted Upload of File with Dangerous Type vulnerability affecting the Jackzhu Photokit WordPress plugin. This vulnerability allows unauthenticated attackers to upload arbitrary files, including web shells, to the web server. Due to the lack of proper file type validation, attackers can gain complete control over affected WordPress installations by uploading and executing malicious PHP scripts.

Critical Impact

This vulnerability enables unauthenticated remote attackers to upload web shells and execute arbitrary code on the server, potentially leading to complete site compromise, data theft, and lateral movement within the hosting environment.

Affected Products

• Jackzhu Photokit WordPress plugin version 1.0 and earlier
• WordPress installations running the vulnerable Photokit plugin
• Web servers hosting affected WordPress sites

Discovery Timeline

• 2024-10-20 - CVE-2024-49610 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2024-49610

Vulnerability Analysis

This vulnerability stems from inadequate file upload validation in the Photokit WordPress plugin. The plugin fails to properly verify the type, content, and extension of uploaded files before storing them on the server. This allows attackers to bypass any intended restrictions and upload files with dangerous extensions such as .php, .phtml, or other executable file types.

The attack can be executed remotely over the network without requiring any authentication or user interaction. Once a malicious file is uploaded, the attacker can access it via a direct URL request, triggering server-side execution of the embedded code. This provides the attacker with the ability to execute arbitrary commands, read sensitive files, modify database contents, or establish persistent backdoor access.

Root Cause

The root cause is CWE-434: Unrestricted Upload of File with Dangerous Type. The Photokit plugin does not implement proper server-side validation of uploaded files. Key security controls that are missing include:

• File extension whitelisting
• MIME type verification
• File content inspection
• Randomization of uploaded file names and storage locations
• Execution prevention in upload directories

Attack Vector

The attack is network-based and can be executed by any unauthenticated remote attacker. The exploitation path typically involves:

1. Identifying a WordPress site running the vulnerable Photokit plugin
2. Locating the file upload endpoint exposed by the plugin
3. Crafting a malicious PHP file (web shell) disguised or submitted directly
4. Uploading the malicious file through the vulnerable endpoint
5. Accessing the uploaded file via its URL to trigger code execution
6. Executing arbitrary commands on the server with the web server's privileges

The vulnerability allows direct upload of web shells to the server. When the attacker navigates to the uploaded PHP file's URL, the web server executes the malicious code, granting the attacker command execution capabilities. This can include functions like system(), exec(), passthru(), or shell_exec() to run operating system commands. For detailed technical information, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-49610

Indicators of Compromise

• Unexpected PHP files in WordPress upload directories or plugin folders
• Web server access logs showing requests to unusual PHP files in upload paths
• New or modified files with recent timestamps in the wp-content/uploads/ directory
• Presence of common web shell signatures such as base64-encoded payloads or obfuscated PHP code

Detection Strategies

• Monitor file system changes in WordPress directories, particularly wp-content/uploads/ and plugin folders
• Implement web application firewall (WAF) rules to detect file upload attempts with executable extensions
• Scan for known web shell signatures using file integrity monitoring tools
• Review web server logs for POST requests to plugin upload endpoints followed by GET requests to uploaded PHP files

Monitoring Recommendations

• Enable WordPress file integrity monitoring to detect unauthorized file additions
• Configure alerts for new PHP files created in upload directories
• Monitor outbound network connections from the web server for potential command-and-control traffic
• Implement logging of all file upload operations with file type and size metadata

How to Mitigate CVE-2024-49610

Immediate Actions Required

• Remove or deactivate the Photokit plugin immediately from all WordPress installations
• Audit the wp-content/uploads/ directory and plugin folders for suspicious PHP files
• Review web server access logs for evidence of exploitation attempts
• If compromise is suspected, perform a full malware scan and consider restoring from a known-clean backup

Patch Information

No official patch has been released for this vulnerability. The affected versions include Photokit version 1.0 and all earlier versions. Site administrators should remove the vulnerable plugin and seek alternative solutions for image editing functionality. Monitor the WordPress plugin repository and the Patchstack Vulnerability Report for any future security updates.

Workarounds

• Completely remove the Photokit plugin from WordPress installations
• Block access to the plugin's upload endpoints at the web server or WAF level
• Implement server-side configuration to prevent PHP execution in upload directories
• Use security plugins that provide file upload monitoring and blocking capabilities

# Apache: Prevent PHP execution in uploads directory
# Add to .htaccess in wp-content/uploads/
<FilesMatch "\.php$">
    Require all denied
</FilesMatch>

# Nginx: Prevent PHP execution in uploads directory
# Add to server block configuration
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}