CVE-2024-52429: WP Quick Setup RCE Vulnerability

CVE-2024-52429 Overview

CVE-2024-52429 is an unrestricted file upload vulnerability [CWE-434] in the AntonHoelstad WP Quick Setup plugin for WordPress. The flaw affects all versions of wp-quick-setup up to and including version 2.0. Authenticated attackers can abuse the plugin's arbitrary plugin and theme installation functionality to upload files of dangerous types, including PHP web shells, to the web server. Successful exploitation leads to remote code execution in the WordPress context.

Critical Impact
Authenticated attackers with low privileges can upload a web shell to the WordPress server and execute arbitrary code, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

AntonHoelstad WP Quick Setup plugin for WordPress
All versions from initial release through 2.0
WordPress sites with wp-quick-setup installed and activated

Discovery Timeline

2024-11-18 - CVE-2024-52429 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52429

Vulnerability Analysis

The WP Quick Setup plugin provides functionality to bulk-install plugins and themes during WordPress site provisioning. The plugin fails to properly restrict the type of files accepted through its installation routine. An authenticated user with low-level privileges can supply an arbitrary archive or file reference, causing the plugin to install attacker-controlled code as a WordPress extension.

Because WordPress plugins and themes are executed as PHP within the web server process, uploading a malicious plugin ZIP effectively results in remote code execution. The attacker gains the ability to run arbitrary commands under the web server user context, read database credentials from wp-config.php, and pivot to other resources on the host.

The vulnerability is network-reachable and requires only low privileges, making it exploitable by any authenticated user session on affected sites.

Root Cause

The root cause is missing validation of file types and source authenticity during the plugin and theme installation workflow. The affected code paths accept installation payloads without enforcing capability checks appropriate to the sensitive nature of installing executable code, and without validating file extensions or MIME types against a strict allowlist.

Attack Vector

An authenticated attacker sends a crafted request to the plugin's installation endpoint, providing a reference to a malicious plugin or theme archive containing PHP code. The plugin extracts and installs this archive into the WordPress wp-content/plugins/ or wp-content/themes/ directory. The attacker then requests the deployed PHP file directly to trigger web shell execution.

Refer to the Patchstack Vulnerability Advisory for additional technical details.

Detection Methods for CVE-2024-52429

Indicators of Compromise

Unexpected new directories or PHP files under wp-content/plugins/ or wp-content/themes/ that do not correspond to a known administrator action.
HTTP POST requests to WP Quick Setup admin-ajax or REST endpoints containing plugin or theme installation parameters from non-administrator sessions.
Outbound network connections from the web server process to unfamiliar hosts shortly after plugin installation events.
PHP files containing obfuscated eval, base64_decode, assert, or system calls in plugin or theme directories.

Detection Strategies

Monitor WordPress audit logs for plugin and theme installation events initiated by users other than trusted administrators.
Inspect web access logs for POST requests targeting wp-quick-setup endpoints followed by GET requests to newly created PHP paths.
File integrity monitoring on wp-content/plugins/ and wp-content/themes/ to alert on unexpected additions or modifications.

Monitoring Recommendations

Enable WordPress activity logging and forward events to a centralized SIEM for correlation with web server logs.
Alert on web server processes (php-fpm, apache2, nginx) spawning shell interpreters such as /bin/sh, bash, or python.
Track outbound egress from web servers and flag connections to IPs or domains not on an approved allowlist.

How to Mitigate CVE-2024-52429

Immediate Actions Required

Deactivate and remove the WP Quick Setup plugin from all WordPress installations until a fixed version is confirmed available.
Audit wp-content/plugins/ and wp-content/themes/ for unexpected files and remove any unauthorized additions.
Rotate WordPress administrator credentials, database passwords in wp-config.php, and API keys stored on the affected host.
Review user accounts and remove any suspicious low-privilege accounts that may have been used for exploitation.

Patch Information

At the time of this writing, no fixed version beyond 2.0 is referenced in the NVD entry. Consult the Patchstack Vulnerability Advisory for the latest patch status and vendor guidance. Until a validated patch is confirmed, uninstall the plugin.

Workarounds

Remove the wp-quick-setup plugin directory entirely from affected WordPress instances.
Restrict access to /wp-admin/ using web server IP allowlisting or an authenticating reverse proxy.
Deploy a Web Application Firewall rule to block requests to WP Quick Setup installation endpoints originating from non-administrator sessions.
Enforce the WordPress DISALLOW_FILE_MODS constant in wp-config.php to disable plugin and theme installation platform-wide.

bash

# Disable plugin/theme installation and file editing in wp-config.php
define( 'DISALLOW_FILE_MODS', true );
define( 'DISALLOW_FILE_EDIT', true );

# Remove the vulnerable plugin from the server
rm -rf /var/www/html/wp-content/plugins/wp-quick-setup

# Verify no attacker-planted plugins remain
find /var/www/html/wp-content/plugins -name '*.php' -mtime -30 -ls