CVE-2024-54285: SeedProd Pro File Upload RCE Vulnerability

CVE-2024-54285 Overview

CVE-2024-54285 is a critical unrestricted file upload vulnerability affecting the SeedProd Pro WordPress plugin. The flaw allows authenticated attackers with high privileges to upload arbitrary files, including web shells, to the underlying web server. Successful exploitation leads to remote code execution (RCE) on the WordPress host. The vulnerability affects all versions of SeedProd Pro up to and including 6.18.10. The issue is tracked under CWE-434 (Unrestricted Upload of File with Dangerous Type). Patchstack assigned the CVE on December 16, 2024, after coordinated disclosure with SeedProd LLC.

Critical Impact

An attacker who uploads a web shell gains arbitrary code execution under the web server process, compromising site integrity, confidentiality, and availability.

Affected Products

• SeedProd Pro WordPress plugin versions through 6.18.10
• WordPress installations with SeedProd Pro (Coming Soon Pro) enabled
• Sites where untrusted users hold high-privilege roles capable of plugin operations

Discovery Timeline

• 2024-12-16 - CVE-2024-54285 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-54285

Vulnerability Analysis

The vulnerability stems from missing or insufficient file type validation in a SeedProd Pro upload handler. The plugin accepts user-supplied files without enforcing strict MIME type, extension, or content checks. An authenticated attacker can submit a PHP file disguised as a permitted asset such as an image or template resource. Once written to a web-accessible directory, the file executes when requested over HTTP.

Because the attack vector is network-based and requires no user interaction, exploitation can be fully automated against vulnerable hosts. The scope is changed (S:C), meaning the compromised plugin context affects the entire WordPress site and underlying server resources.

Root Cause

The root cause is improper enforcement of file extension and content-type allowlists in the plugin's upload endpoint. The handler trusts client-supplied metadata rather than validating file contents against expected formats. This pattern matches CWE-434, where dangerous file types reach executable directories.

Attack Vector

An attacker authenticates as a high-privilege user, then sends a crafted multipart upload request to the SeedProd Pro upload endpoint. The payload is a PHP web shell with a manipulated extension, content-type header, or polyglot structure. The server stores the file in a directory served by the web application. The attacker then requests the file directly to trigger PHP execution and gain a command channel.

The vulnerability mechanism is detailed in the Patchstack WordPress Vulnerability Report. No public proof-of-concept exploit code has been released. The EPSS probability is 0.62% at the 70th percentile, indicating moderate likelihood of exploitation attempts.

Detection Methods for CVE-2024-54285

Indicators of Compromise

• Unexpected .php, .phtml, or .phar files in SeedProd plugin upload directories under wp-content/uploads/ or plugin-specific paths
• HTTP POST requests to SeedProd Pro upload endpoints followed by GET requests to newly created files in the same directory
• Outbound connections from the www-data or PHP-FPM process to unfamiliar IP addresses shortly after upload activity
• New WordPress administrator accounts or modified wp-config.php timestamps following plugin upload activity

Detection Strategies

• Monitor WordPress upload directories for files with executable extensions using file integrity monitoring (FIM)
• Inspect web server access logs for POST requests to plugin upload routes followed by GET requests to attacker-controlled filenames
• Apply web application firewall (WAF) rules that block uploads containing PHP tags (<?php, <?=) in file content regardless of extension
• Audit privileged WordPress user activity through plugin audit logs and database revisions

Monitoring Recommendations

• Enable verbose logging on the WordPress instance and forward logs to a centralized SIEM for correlation
• Alert on creation of any file with a PHP-handled extension inside wp-content/uploads/ paths
• Track process lineage where the web server spawns shells, interpreters, or network utilities

How to Mitigate CVE-2024-54285

Immediate Actions Required

• Update SeedProd Pro to a version later than 6.18.10 as soon as the vendor patch is available
• Audit wp-content/ directories for unauthorized PHP files and remove any not associated with installed plugins or themes
• Rotate WordPress administrator credentials, API keys, and database passwords if compromise is suspected
• Review and restrict high-privilege accounts to trusted administrators only

Patch Information

Users must upgrade SeedProd Pro to a release beyond 6.18.10 that addresses the unrestricted upload flaw. Refer to the Patchstack advisory for the fixed version and vendor guidance. Until the patch is applied, treat the plugin as actively vulnerable on any internet-exposed WordPress instance.

Workarounds

• Deactivate the SeedProd Pro plugin until a patched version is installed
• Configure the web server to deny PHP execution within wp-content/uploads/ directories using directives below
• Restrict access to WordPress administrative endpoints (wp-admin, wp-login.php) by source IP where feasible
• Deploy a WAF rule set with upload filtering that inspects file magic bytes rather than relying on extensions

# Apache: deny PHP execution in WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|phps)$">
    Require all denied
</FilesMatch>

# Nginx equivalent in server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}