CVE-2024-50498: Lubus WP Query Console RCE Vulnerability

CVE-2024-50498 Overview

CVE-2024-50498 is a critical Code Injection vulnerability affecting the LUBUS WP Query Console plugin for WordPress. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code on vulnerable WordPress installations, potentially leading to complete site compromise.

Critical Impact

Unauthenticated remote code execution enables attackers to take full control of affected WordPress sites, steal sensitive data, install backdoors, or use the compromised server for further attacks.

Affected Products

• LUBUS WP Query Console version 1.0 and all prior versions
• WordPress installations with the WP Query Console plugin active

Discovery Timeline

• 2024-10-28 - CVE-2024-50498 published to NVD
• 2024-10-31 - Last updated in NVD database

Technical Details for CVE-2024-50498

Vulnerability Analysis

The WP Query Console plugin by LUBUS contains improper control of code generation, classified under CWE-94 (Improper Control of Generation of Code). This vulnerability enables attackers to inject malicious code that gets executed on the server without requiring any authentication or user interaction.

The plugin appears to allow direct execution of PHP code or WordPress queries without adequate input sanitization or access controls. In a properly designed development tool, such functionality would be restricted to authenticated administrators and would include robust input validation. The absence of these security controls creates a direct path for remote code execution.

Root Cause

The root cause stems from improper input validation and missing access controls within the WP Query Console plugin. The plugin fails to properly sanitize user-supplied input before processing it as executable code, and does not enforce authentication requirements for sensitive functionality. This allows untrusted input to be interpreted and executed as code on the server.

Attack Vector

The vulnerability is exploitable over the network without any prior authentication or user interaction required. An attacker can send specially crafted requests to WordPress installations running the vulnerable plugin to inject and execute arbitrary PHP code. The attack complexity is low, making this vulnerability particularly dangerous for exposed WordPress sites.

Successful exploitation grants the attacker the same privileges as the web server process, typically allowing full read/write access to the WordPress installation, database access, and potential lateral movement within the hosting environment.

Detection Methods for CVE-2024-50498

Indicators of Compromise

• Unusual HTTP POST requests targeting WP Query Console plugin endpoints
• Unexpected PHP process spawning or command execution on the web server
• New or modified PHP files in the WordPress installation directory
• Suspicious database queries or new administrator accounts
• Web server logs showing attempts to access plugin-specific AJAX handlers

Detection Strategies

• Monitor web application firewall logs for code injection patterns in requests to WordPress
• Implement file integrity monitoring on WordPress core files and plugin directories
• Review access logs for requests containing PHP code patterns or encoded payloads
• Deploy endpoint detection solutions to identify suspicious process execution chains

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests and plugin activity
• Configure alerts for new file creation in WordPress directories
• Monitor for unusual outbound network connections from the web server
• Set up database query logging to detect unauthorized data access attempts

How to Mitigate CVE-2024-50498

Immediate Actions Required

• Immediately deactivate and remove the WP Query Console plugin from all WordPress installations
• Audit affected systems for signs of compromise or unauthorized access
• Review and remove any suspicious administrator accounts or modified files
• Consider restoring from a known-good backup if compromise is suspected
• Implement web application firewall rules to block code injection attempts

Patch Information

No patch is currently available for this vulnerability. The affected version (1.0) is the only known release, and no security update has been published by the vendor. Organizations should remove this plugin entirely until a patched version becomes available. For detailed vulnerability information, see the Patchstack Vulnerability Report.

Workarounds

• Remove the WP Query Console plugin from production WordPress installations immediately
• If removal is not immediately possible, restrict access to the WordPress admin area by IP address
• Implement a web application firewall with rules to block code injection attempts
• Use security plugins to monitor for suspicious activity until the plugin can be removed

# Deactivate and delete the vulnerable plugin via WP-CLI
wp plugin deactivate wp-query-console --path=/var/www/html/wordpress
wp plugin delete wp-query-console --path=/var/www/html/wordpress

# Verify plugin has been removed
wp plugin list --path=/var/www/html/wordpress | grep -i query