CVE-2024-56051: WPLMS WordPress LMS RCE Vulnerability

CVE-2024-56051 Overview

CVE-2024-56051 is a code injection vulnerability in the VibeThemes WPLMS plugin for WordPress. The flaw affects all versions of WPLMS up to and including 1.9.9.5. An authenticated attacker with student-level privileges can inject and execute arbitrary code on the underlying server. The vulnerability is classified under CWE-94: Improper Control of Generation of Code.

WPLMS is a widely deployed Learning Management System plugin used by educational platforms and corporate training sites. Successful exploitation grants attackers full remote code execution against the WordPress host.

Critical Impact
Authenticated students can achieve remote code execution on the WordPress server, compromising confidentiality, integrity, and availability.

Affected Products

VibeThemes WPLMS plugin versions prior to 1.9.9.5
WordPress sites running the WPLMS Learning Management System
Any deployment allowing student-tier account registration on vulnerable WPLMS versions

Discovery Timeline

2024-12-18 - CVE-2024-56051 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56051

Vulnerability Analysis

The WPLMS plugin fails to properly control the generation of code from user-supplied input. An authenticated user holding a student role can submit crafted payloads that the plugin interprets and executes as PHP code within the WordPress runtime. The result is arbitrary code execution in the context of the web server process.

The attack requires network access and low privileges. No user interaction is needed once the attacker holds a valid student account, which is often trivially obtainable through open enrollment on training sites.

Root Cause

The root cause is improper handling of untrusted input in a code-generation path within WPLMS. Input intended as data is instead concatenated into a code construct or passed to a dynamic execution primitive such as eval, create_function, call_user_func, or similar reflective calls. Because the plugin does not validate or sanitize the input against an allowlist, attacker-controlled strings become executable code.

Attack Vector

Exploitation proceeds over the network against the WordPress HTTP endpoints exposed by WPLMS. An attacker registers or authenticates as a student, then issues a crafted request to a vulnerable WPLMS action or AJAX handler. The plugin evaluates the injected payload server-side, allowing the attacker to run PHP, drop webshells, exfiltrate the WordPress database, or pivot into the hosting environment.

No public proof-of-concept code is available in the referenced advisory. Technical details are documented in the Patchstack advisory for WPLMS.

Detection Methods for CVE-2024-56051

Indicators of Compromise

Unexpected PHP files or webshells appearing in wp-content/uploads/ or WPLMS plugin directories
POST requests to WPLMS AJAX endpoints or admin-ajax handlers containing serialized payloads, PHP keywords such as system, exec, passthru, or base64-encoded blobs
New or modified WordPress administrator accounts following student-level authentication events
Outbound network connections from the WordPress host to unfamiliar IP addresses shortly after WPLMS request activity

Detection Strategies

Monitor WordPress access logs for authenticated student sessions issuing high volumes of requests to WPLMS action parameters
Deploy a Web Application Firewall (WAF) rule set that flags PHP function names and dynamic execution keywords appearing in request bodies
Use file integrity monitoring on the WordPress installation to detect additions or changes under the plugin and uploads directories

Monitoring Recommendations

Enable WordPress audit logging for role changes, plugin edits, and file uploads tied to student accounts
Forward web server, PHP-FPM, and WordPress logs to a centralized platform for correlation across authentication and request activity
Alert on child processes spawned by the PHP interpreter, such as sh, bash, curl, wget, or nc, which indicate post-exploitation activity

How to Mitigate CVE-2024-56051

Immediate Actions Required

Update the WPLMS plugin to a version later than 1.9.9.5 on all affected WordPress sites
Audit student and subscriber accounts for suspicious registrations created before patching
Inspect the WordPress filesystem for webshells, backdoors, or unauthorized plugin modifications
Rotate WordPress secret keys, administrator passwords, and database credentials if compromise is suspected

Patch Information

VibeThemes has released a fixed version of WPLMS that addresses the code injection flaw. Administrators should upgrade beyond version 1.9.9.5 through the WordPress plugin manager or by downloading the current release directly from the vendor. Refer to the Patchstack advisory for advisory details.

Workarounds

Disable the WPLMS plugin until the patched version can be installed
Restrict new student registration and require manual approval of accounts on public-facing learning sites
Deploy WAF rules to block requests containing PHP execution primitives targeting WPLMS endpoints
Enforce least privilege on the PHP process and prevent write access to plugin directories at the filesystem layer

bash

# Configuration example: temporarily disable the WPLMS plugin via WP-CLI
wp plugin deactivate wplms

# After patching, update and reactivate
wp plugin update wplms
wp plugin activate wplms