CVE-2024-56050: WPLMS Plugin RCE Vulnerability

CVE-2024-56050 Overview

CVE-2024-56050 is an unrestricted file upload vulnerability in the VibeThemes WPLMS plugin for WordPress. The flaw affects all versions of WPLMS up to and including 1.9.9.5.3. Authenticated users with low-privilege roles such as subscriber can upload files of dangerous types, including PHP web shells, to the web server. Successful exploitation grants attackers arbitrary code execution in the context of the web server process. The issue is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type and carries a CVSS 3.1 base score of 8.8.

Critical Impact
A subscriber-level account can upload a web shell and gain remote code execution on any WordPress site running WPLMS through 1.9.9.5.3.

Affected Products

VibeThemes WPLMS (WordPress Learning Management System) plugin
All versions from initial release through 1.9.9.5.3
WordPress sites using WPLMS for e-learning functionality

Discovery Timeline

2024-12-18 - CVE-2024-56050 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56050

Vulnerability Analysis

The WPLMS plugin exposes a file upload endpoint that fails to restrict the MIME types and extensions permitted during upload. Authenticated users with the subscriber role, the lowest privileged WordPress role, can reach this endpoint. Attackers submit files with executable extensions such as .php and place them within the web root. The server subsequently executes the uploaded file when the attacker requests it over HTTP. The vulnerability falls under CWE-434, which covers upload handlers that omit type validation, extension allowlisting, or content inspection.

Root Cause

The plugin's upload handler does not enforce a strict allowlist of safe file extensions and does not verify file contents against declared types. It also stores uploaded files in a publicly accessible directory without renaming or sandboxing them. These missing controls allow attackers to place PHP source files where the WordPress runtime will parse and execute them.

Attack Vector

The attack requires network access to the WordPress site and a valid subscriber-level account. Since many WPLMS sites permit self-registration for course enrollment, obtaining that account is trivial. The attacker authenticates, invokes the vulnerable upload endpoint, and submits a PHP web shell. The attacker then browses to the uploaded file's URL to execute commands, read database credentials from wp-config.php, or pivot into the underlying host. See the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-56050

Indicators of Compromise

New files with .php, .phtml, or .phar extensions inside wp-content/uploads/ or WPLMS-managed directories
HTTP POST requests to WPLMS upload endpoints originating from newly registered subscriber accounts
Outbound network connections from the www-data or PHP-FPM process to unfamiliar external hosts
WordPress user accounts created shortly before file upload activity, especially from anonymizing proxies

Detection Strategies

Inventory WordPress installations and flag any running WPLMS at or below version 1.9.9.5.3
Alert on any executable file written under wp-content/uploads/ using file integrity monitoring
Review web server access logs for POST requests to WPLMS AJAX or upload actions followed by GET requests to newly created files
Correlate subscriber account creation events with subsequent upload activity in short time windows

Monitoring Recommendations

Enable detailed WordPress audit logging for user role changes, file uploads, and plugin activity
Stream web server and PHP error logs to a centralized platform for correlation across sites
Monitor process creation on the web server host for shells spawned by the PHP interpreter
Track outbound DNS and HTTP requests from web server workloads to identify command-and-control traffic

How to Mitigate CVE-2024-56050

Immediate Actions Required

Update WPLMS to a version later than 1.9.9.5.3 as soon as the vendor patch is available
Disable open user registration on affected WordPress sites until patched
Audit wp-content/uploads/ and WPLMS directories for unauthorized PHP files and remove them
Rotate all WordPress administrator passwords, secret keys in wp-config.php, and database credentials if compromise is suspected

Patch Information

VibeThemes addresses the issue in versions above WPLMS 1.9.9.5.3. Administrators should consult the Patchstack Vulnerability Report and the VibeThemes changelog to confirm the fixed release before updating production sites.

Workarounds

Block PHP execution within wp-content/uploads/ using web server configuration until patching is complete
Restrict access to WPLMS upload endpoints at the web application firewall using IP allowlisting or authentication rules
Temporarily remove the subscriber role's ability to reach the vulnerable upload handler by disabling course enrollment features
Deactivate the WPLMS plugin on non-production and low-traffic sites where the learning management system is not actively used

bash

# Apache: deny PHP execution in the WordPress uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|phps)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}