CVE-2024-50530: Stars SMTP Mailer RCE Vulnerability

CVE-2024-50530 Overview

CVE-2024-50530 is an unrestricted file upload vulnerability in the Myriad Solutionz Stars SMTP Mailer plugin for WordPress. The flaw affects all plugin versions up to and including 2.2.1. Authenticated attackers with low-privilege access can upload files of dangerous types, including web shells, directly to the web server. Successful exploitation results in arbitrary code execution within the WordPress hosting context. The weakness is tracked under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Authenticated attackers can upload web shells to fully compromise the WordPress server, achieving remote code execution, data theft, and persistent access.

Affected Products

Myriad Solutionz Stars SMTP Mailer WordPress plugin, all versions through 2.2.1
WordPress sites running the stars-smtp-mailer plugin
Any hosting environment where the plugin is installed and active

Discovery Timeline

2024-11-04 - CVE-2024-50530 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50530

Vulnerability Analysis

The Stars SMTP Mailer plugin exposes a file upload handler that fails to validate file type, extension, or MIME content. Attackers with a low-privilege authenticated session can submit a PHP web shell through the vulnerable endpoint. The uploaded file is written to a web-accessible directory and can be executed by requesting its URL.

Exploitation requires only network access and low privileges, with no user interaction. The result is full compromise of confidentiality, integrity, and availability on the target host. Because WordPress plugins execute in the same context as the web server user, an uploaded shell can read database credentials in wp-config.php, pivot to other hosted sites, and establish persistence.

Root Cause

The root cause is missing server-side validation on the file upload routine. The plugin does not enforce an allowlist of safe extensions, does not verify MIME types, and does not rename or sanitize user-supplied filenames. This design flaw maps to CWE-434, which covers unrestricted upload of files with dangerous types.

Attack Vector

An authenticated attacker sends a crafted multipart HTTP request to the plugin's upload endpoint containing a PHP file with malicious payload. The server accepts the upload without extension filtering and stores it under the WordPress wp-content directory tree. The attacker then requests the uploaded file directly, causing the PHP interpreter to execute the embedded code and return a remote shell interface.

See the Patchstack Vulnerability Report for further technical detail.

Detection Methods for CVE-2024-50530

Indicators of Compromise

Unexpected .php, .phtml, or .phar files under wp-content/uploads/ or plugin-managed directories
HTTP POST requests to Stars SMTP Mailer plugin endpoints containing multipart/form-data from low-privilege user sessions
Outbound network connections from the www-data or PHP-FPM process to unfamiliar IP addresses
New or modified administrator accounts in the WordPress database following a plugin upload event

Detection Strategies

Monitor web server access logs for POST requests to stars-smtp-mailer endpoints followed by GET requests to newly created files
Compare current plugin directory contents against a known-good baseline of files shipped with the plugin
Alert on PHP files written to upload directories, which should never contain executable server-side scripts

Monitoring Recommendations

Enable file integrity monitoring across wp-content/uploads/ and all plugin directories
Forward WordPress and web server logs to a centralized SIEM for correlation of upload and execution events
Track process lineage on the web server to detect child processes spawned from the PHP interpreter that deviate from normal application behavior

How to Mitigate CVE-2024-50530

Immediate Actions Required

Deactivate and remove the Stars SMTP Mailer plugin until a patched version is confirmed available from the vendor
Audit all files under wp-content/uploads/ for unauthorized PHP or other executable content and remove them
Rotate WordPress administrator credentials and any secrets stored in wp-config.php if compromise is suspected
Review user accounts and remove any unfamiliar administrator or editor roles

Patch Information

At the time of NVD publication, all versions through 2.2.1 are affected. Consult the Patchstack Vulnerability Report and the vendor's plugin page for updated patch availability. Apply the fixed release as soon as the vendor publishes one.

Workarounds

Restrict access to WordPress authenticated user roles and disable open registration where possible
Configure the web server to deny PHP execution within wp-content/uploads/ using directives such as php_flag engine off or an equivalent location block
Deploy a web application firewall rule that blocks uploads of files with executable extensions to plugin endpoints

bash

# Example Apache configuration to disable PHP execution in uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php7|php8)$">
        Require all denied
    </FilesMatch>
    php_flag engine off
</Directory>