CVE-2024-50498: Lubus WP Query Console RCE Vulnerability

CVE-2024-50498 Overview

CVE-2024-50498 is a critical Code Injection vulnerability affecting the LUBUS WP Query Console plugin for WordPress. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code on vulnerable WordPress installations, potentially leading to complete site compromise.

Critical Impact
Unauthenticated remote code execution enables attackers to take full control of affected WordPress sites, steal sensitive data, install backdoors, or use the compromised server for further attacks.

Affected Products

LUBUS WP Query Console version 1.0 and all prior versions
WordPress installations with the WP Query Console plugin active

Discovery Timeline

2024-10-28 - CVE-2024-50498 published to NVD
2024-10-31 - Last updated in NVD database

Technical Details for CVE-2024-50498

Vulnerability Analysis

The WP Query Console plugin by LUBUS contains improper control of code generation, classified under CWE-94 (Improper Control of Generation of Code). This vulnerability enables attackers to inject malicious code that gets executed on the server without requiring any authentication or user interaction.

The plugin appears to allow direct execution of PHP code or WordPress queries without adequate input sanitization or access controls. In a properly designed development tool, such functionality would be restricted to authenticated administrators and would include robust input validation. The absence of these security controls creates a direct path for remote code execution.

Root Cause

The root cause stems from improper input validation and missing access controls within the WP Query Console plugin. The plugin fails to properly sanitize user-supplied input before processing it as executable code, and does not enforce authentication requirements for sensitive functionality. This allows untrusted input to be interpreted and executed as code on the server.

Attack Vector

The vulnerability is exploitable over the network without any prior authentication or user interaction required. An attacker can send specially crafted requests to WordPress installations running the vulnerable plugin to inject and execute arbitrary PHP code. The attack complexity is low, making this vulnerability particularly dangerous for exposed WordPress sites.

Successful exploitation grants the attacker the same privileges as the web server process, typically allowing full read/write access to the WordPress installation, database access, and potential lateral movement within the hosting environment.

Detection Methods for CVE-2024-50498

Indicators of Compromise

Unusual HTTP POST requests targeting WP Query Console plugin endpoints
Unexpected PHP process spawning or command execution on the web server
New or modified PHP files in the WordPress installation directory
Suspicious database queries or new administrator accounts
Web server logs showing attempts to access plugin-specific AJAX handlers

Detection Strategies

Monitor web application firewall logs for code injection patterns in requests to WordPress
Implement file integrity monitoring on WordPress core files and plugin directories
Review access logs for requests containing PHP code patterns or encoded payloads
Deploy endpoint detection solutions to identify suspicious process execution chains

Monitoring Recommendations

Enable detailed logging for WordPress AJAX requests and plugin activity
Configure alerts for new file creation in WordPress directories
Monitor for unusual outbound network connections from the web server
Set up database query logging to detect unauthorized data access attempts

How to Mitigate CVE-2024-50498

Immediate Actions Required

Immediately deactivate and remove the WP Query Console plugin from all WordPress installations
Audit affected systems for signs of compromise or unauthorized access
Review and remove any suspicious administrator accounts or modified files
Consider restoring from a known-good backup if compromise is suspected
Implement web application firewall rules to block code injection attempts

Patch Information

No patch is currently available for this vulnerability. The affected version (1.0) is the only known release, and no security update has been published by the vendor. Organizations should remove this plugin entirely until a patched version becomes available. For detailed vulnerability information, see the Patchstack Vulnerability Report.

Workarounds

Remove the WP Query Console plugin from production WordPress installations immediately
If removal is not immediately possible, restrict access to the WordPress admin area by IP address
Implement a web application firewall with rules to block code injection attempts
Use security plugins to monitor for suspicious activity until the plugin can be removed

bash

# Deactivate and delete the vulnerable plugin via WP-CLI
wp plugin deactivate wp-query-console --path=/var/www/html/wordpress
wp plugin delete wp-query-console --path=/var/www/html/wordpress

# Verify plugin has been removed
wp plugin list --path=/var/www/html/wordpress | grep -i query