CVE-2024-50529: Training Courses Plugin RCE Vulnerability

CVE-2024-50529 Overview

CVE-2024-50529 is an unrestricted file upload vulnerability in the Rudrainnovative Training – Courses WordPress plugin. The flaw affects all versions up to and including 2.0.1. Authenticated attackers with low privileges can upload files of dangerous types, including web shells, to the target WordPress server. Successful exploitation leads to arbitrary code execution in the context of the web application. The issue is tracked under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact
An authenticated attacker can upload a PHP web shell and achieve remote code execution on the WordPress host, compromising site confidentiality, integrity, and availability.

Affected Products

Rudrainnovative Training – Courses WordPress plugin versions n/a through 2.0.1
WordPress sites with the plugin installed and active
Any downstream WordPress deployment bundling the vulnerable plugin version

Discovery Timeline

2024-11-04 - CVE-2024-50529 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-50529

Vulnerability Analysis

The Training – Courses plugin exposes a file upload endpoint that fails to validate uploaded file types, extensions, or MIME headers. An authenticated user with low privileges can submit a request containing a PHP file disguised as a course asset. The plugin writes the attacker-controlled file into a web-accessible directory under wp-content/uploads/. Because the file remains executable by the PHP handler, requesting its URL executes attacker code.

This class of flaw belongs to the CWE-434 category. It converts a low-privilege application account into full server-side code execution. The attacker can then pivot to database access, credential theft, or lateral movement across the hosting environment.

Root Cause

The plugin's upload handler does not enforce an allowlist of safe file extensions or content types. It also does not rename files to non-executable extensions or store them outside the web root. Missing server-side validation on user-controlled multipart/form-data requests is the underlying defect.

Attack Vector

Exploitation occurs over the network against the WordPress site. The attacker authenticates with any account granted access to the plugin's upload functionality, then submits a crafted upload request. No user interaction from an administrator is required. The uploaded web shell is invoked by issuing a subsequent HTTP GET or POST to its stored location. See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2024-50529

Indicators of Compromise

Unexpected .php, .phtml, .phar, or .pht files in wp-content/uploads/ directories associated with the Training – Courses plugin
Outbound network connections from the WordPress PHP worker process to unfamiliar hosts
New or modified WordPress administrator accounts appearing shortly after plugin upload activity
HTTP requests to uploaded files under the plugin's upload path returning dynamic content

Detection Strategies

Inspect web server access logs for POST requests to plugin upload endpoints followed by GET requests to .php files in wp-content/uploads/
File-integrity monitoring on the wp-content/uploads/ tree to flag any PHP or executable script files
Scan the plugin's storage directories with YARA rules for common PHP web shell patterns such as eval($_POST, assert($_REQUEST, or system($_GET

Monitoring Recommendations

Alert on process execution chains where php-fpm or apache2 spawns shell interpreters such as /bin/sh, bash, or python
Monitor the WordPress plugin registry and version pin for training to identify vulnerable installations across your estate
Correlate authentication events for low-privilege WordPress accounts with file write operations under wp-content/uploads/

How to Mitigate CVE-2024-50529

Immediate Actions Required

Disable and remove the Training – Courses plugin on any WordPress site running version 2.0.1 or earlier until a fixed version is confirmed
Audit wp-content/uploads/ for unauthorized PHP or script files and remove any web shells found
Rotate WordPress credentials, API keys, and database passwords if evidence of exploitation exists
Review WordPress user accounts and revoke any unrecognized administrator or editor roles

Patch Information

At the time of the NVD entry, no vendor-supplied fixed version is referenced. Consult the Patchstack advisory for updated remediation guidance and monitor the plugin repository for a release above 2.0.1.

Workarounds

Block execution of PHP within wp-content/uploads/ using web server configuration to neutralize uploaded web shells
Restrict access to the plugin's upload endpoints via a Web Application Firewall (WAF) rule that inspects filename and content-type headers
Enforce least-privilege on WordPress accounts and disable self-registration to reduce the pool of authenticated attackers

bash

# Apache: deny PHP execution inside the WordPress uploads directory
# Place this in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|pht|php[0-9])$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block:
# location ~* /wp-content/uploads/.*\.(php|phtml|phar|pht|php[0-9])$ {
#     deny all;
#     return 403;
# }