CVE-2024-50511: WP donimedia carousel RCE Vulnerability

CVE-2024-50511 Overview

CVE-2024-50511 is an arbitrary file upload vulnerability in the WP donimedia carousel WordPress plugin (wp-donimedia-carousel). The flaw affects all versions through 1.0.1 and allows authenticated attackers to upload files of dangerous types, including web shells, to the WordPress server. The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. Successful exploitation grants the attacker remote code execution on the underlying web server, leading to full site compromise.

Critical Impact

Authenticated attackers with low privileges can upload web shells, achieve remote code execution, and pivot beyond the WordPress scope to compromise the hosting environment.

Affected Products

• WP donimedia carousel plugin for WordPress
• All versions from initial release through 1.0.1
• WordPress sites with the wp-donimedia-carousel plugin enabled

Discovery Timeline

• 2024-10-30 - CVE-2024-50511 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-50511

Vulnerability Analysis

The WP donimedia carousel plugin exposes a file upload endpoint that fails to validate the type, extension, or MIME content of submitted files. An authenticated user can submit a PHP file, or any executable server-side script, through the plugin's upload handler. The uploaded file lands inside a web-accessible directory under wp-content/uploads/ and is executed by the PHP interpreter when requested directly.

The scope change in the CVSS vector indicates the attacker's impact extends beyond the vulnerable WordPress component. A successful web shell upload grants the attacker the privileges of the web server process, enabling arbitrary command execution, database access, and lateral movement.

The EPSS probability of 0.889% places this issue in the 75th percentile for exploitation likelihood, reflecting the well-understood exploitation pattern for unrestricted upload flaws in WordPress plugins.

Root Cause

The plugin omits server-side validation of uploaded files. There are no checks against a whitelist of permitted extensions, no MIME-type verification, no magic-byte inspection, and no enforcement of safe storage paths outside the document root. The handler also does not strip or sanitize the original filename, allowing the attacker to control the resulting URL of the dropped payload.

Attack Vector

Exploitation requires network access to the WordPress site and a low-privileged authenticated account, such as a Subscriber or Contributor depending on the plugin's role configuration. The attacker submits a crafted multipart upload request to the vulnerable plugin endpoint with a PHP web shell as the payload. After upload, the attacker requests the resulting URL under wp-content/uploads/ to execute arbitrary PHP code. No user interaction is required beyond the initial authentication.

No public proof-of-concept code has been released. The exploitation mechanism is described in the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2024-50511

Indicators of Compromise

• New .php, .phtml, .phar, or .inc files appearing under wp-content/uploads/ or plugin-controlled upload directories
• Outbound HTTP requests originating from the web server process to unexpected destinations following uploads
• Web server access logs showing POST requests to plugin upload endpoints followed by GET requests to newly created files in upload paths
• WordPress user accounts with low privileges suddenly making file upload requests outside normal media workflows

Detection Strategies

• Inventory WordPress installations for the wp-donimedia-carousel plugin and flag any version at or below 1.0.1
• Scan wp-content/uploads/ recursively for executable file types and quarantine matches
• Correlate authentication events with upload activity to identify low-privileged accounts performing administrative-style actions
• Monitor for PHP process spawning sh, bash, python, or curl from within the web server context

Monitoring Recommendations

• Forward web server access logs and PHP-FPM logs to a central SIEM for retention and query
• Alert on file integrity changes within WordPress upload directories using filesystem monitoring
• Track outbound connections from the web server to non-allow-listed IP addresses and domains

How to Mitigate CVE-2024-50511

Immediate Actions Required

• Disable and remove the WP donimedia carousel plugin until a patched release is available
• Audit wp-content/uploads/ for unauthorized executable files and remove them
• Rotate WordPress administrator passwords, API keys, and database credentials if compromise is suspected
• Review and remove unfamiliar WordPress user accounts, especially those created after plugin installation

Patch Information

As of the last NVD update, no fixed version has been published for the WP donimedia carousel plugin. Versions up to and including 1.0.1 remain vulnerable. Site operators should remove the plugin and monitor the Patchstack advisory for vendor updates.

Workarounds

• Block direct execution of PHP files within wp-content/uploads/ using web server configuration
• Deploy a web application firewall rule that inspects multipart uploads to the plugin endpoint and rejects executable extensions
• Restrict plugin access to trusted administrator accounts only, and remove unused low-privilege accounts
• Enforce least-privilege filesystem permissions so the web server process cannot write to directories that are also executable

# Apache configuration to block PHP execution in WordPress uploads
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|inc)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar|inc)$ {
    deny all;
    return 403;
}