CVE-2024-50450: WordPress MDTF Plugin RCE Vulnerability

CVE-2024-50450 Overview

CVE-2024-50450 is a critical Code Injection vulnerability affecting the MDTF (Meta Data and Taxonomies Filter) WordPress plugin developed by RealMag777/Pluginus. This vulnerability allows attackers to inject and execute arbitrary code through improper control of code generation, potentially leading to complete compromise of affected WordPress installations.

Critical Impact

Unauthenticated attackers can exploit this Code Injection vulnerability to execute arbitrary code on vulnerable WordPress sites, potentially leading to full site takeover, data theft, and malware distribution.

Affected Products

• Pluginus WordPress Meta Data and Taxonomies Filter (MDTF) versions up to and including 1.3.3.4
• WordPress installations using the wp-meta-data-filter-and-taxonomy-filter plugin
• All configurations of MDTF plugin prior to the security patch

Discovery Timeline

• 2024-10-28 - CVE-2024-50450 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2024-50450

Vulnerability Analysis

This vulnerability stems from Improper Control of Generation of Code (CWE-94), commonly known as Code Injection. The MDTF WordPress plugin fails to properly sanitize and validate user-supplied input before incorporating it into dynamically generated code. This allows attackers to inject malicious code that gets executed within the context of the WordPress application.

The vulnerability is particularly severe because it can be exploited remotely over the network without requiring any authentication or user interaction. Once exploited, attackers gain the ability to execute arbitrary code with the privileges of the web server, potentially compromising confidentiality, integrity, and availability of the entire WordPress installation.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and improper handling of user-controlled data within the plugin's code generation functionality. The MDTF plugin processes metadata and taxonomy filter parameters without adequately sanitizing them, allowing attackers to inject executable code through crafted input values. This represents a fundamental failure in secure coding practices where untrusted input is incorporated directly into code execution paths.

Attack Vector

This vulnerability is exploited through network-based attacks where malicious actors send specially crafted requests to WordPress sites running vulnerable versions of the MDTF plugin. The attack requires no authentication (anonymous access is sufficient) and no user interaction is needed.

The attack flow typically involves:

1. Attacker identifies a WordPress site using the vulnerable MDTF plugin version 1.3.3.4 or earlier
2. Malicious requests containing injected code are sent to plugin endpoints that process filter parameters
3. The plugin fails to sanitize the malicious input and incorporates it into code execution
4. The injected code executes with the permissions of the web server process
5. Attacker gains ability to read/modify files, access databases, and potentially pivot to other systems

For detailed technical information about this vulnerability, refer to the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2024-50450

Indicators of Compromise

• Unexpected PHP files or modified plugin files within the wp-meta-data-filter-and-taxonomy-filter directory
• Unusual outbound network connections from the WordPress server
• Suspicious entries in web server access logs showing malformed filter parameters
• New administrator accounts or modified user privileges without authorization
• Presence of web shells or backdoors in WordPress installation directories

Detection Strategies

• Deploy web application firewalls (WAF) with rules to detect code injection patterns in HTTP requests
• Implement file integrity monitoring on WordPress plugin directories to detect unauthorized modifications
• Review web server access logs for suspicious requests targeting MDTF plugin endpoints
• Utilize WordPress security plugins to scan for known malicious signatures and file changes

Monitoring Recommendations

• Enable detailed logging for all HTTP requests to WordPress admin and plugin endpoints
• Configure alerts for any file modifications within the WordPress installation directory
• Monitor for unusual database queries that may indicate exploitation attempts
• Set up network monitoring to detect unexpected outbound connections from the web server

How to Mitigate CVE-2024-50450

Immediate Actions Required

• Update the MDTF plugin to a version newer than 1.3.3.4 immediately
• If an update is not available, deactivate and remove the vulnerable plugin until a patch is released
• Review WordPress file system and database for signs of compromise
• Implement a web application firewall (WAF) with code injection detection rules
• Audit WordPress user accounts and remove any unauthorized administrative accounts

Patch Information

Organizations should check the official WordPress plugin repository and the Patchstack WordPress Vulnerability Report for the latest security updates addressing this vulnerability. Ensure that the MDTF plugin is updated to a version that remediates CVE-2024-50450.

Workarounds

• Temporarily disable the MDTF plugin if updates are not immediately available
• Implement WAF rules to block requests containing common code injection patterns
• Restrict access to WordPress admin areas via IP whitelisting where possible
• Enable WordPress debug logging to monitor for exploitation attempts

# WordPress security hardening configuration example
# Add to wp-config.php to enhance security monitoring

# Enable debug logging (review logs, do not expose in production)
define('WP_DEBUG', true);
define('WP_DEBUG_LOG', true);
define('WP_DEBUG_DISPLAY', false);

# Disable file editing from admin panel
define('DISALLOW_FILE_EDIT', true);

# Limit login attempts and monitor access
# Consider using security plugins like Wordfence or Sucuri