CVE-2024-56052: WPLMS Plugin RCE Vulnerability

CVE-2024-56052 Overview

CVE-2024-56052 is an unrestricted file upload vulnerability in the VibeThemes WPLMS plugin for WordPress. The flaw affects all versions up to and including 1.9.9.5.2 of the WordPress Learning Management System. Authenticated users with student-level privileges can upload files of dangerous types, including PHP web shells, directly to the web server. Successful exploitation grants attackers arbitrary code execution in the context of the web server. The vulnerability is tracked under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated attackers with low-privilege student accounts can upload web shells and achieve remote code execution on WordPress servers running vulnerable WPLMS versions.

Affected Products

VibeThemes WPLMS (WordPress Learning Management System) plugin
All versions from initial release through 1.9.9.5.2
WordPress installations using the wplms_plugin component

Discovery Timeline

2024-12-18 - CVE-2024-56052 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56052

Vulnerability Analysis

The WPLMS plugin exposes an upload endpoint accessible to authenticated users holding the student role. The endpoint fails to validate the file type, extension, and MIME properties of submitted files. Attackers can submit PHP files or other executable content that WordPress subsequently stores within the web root. Once uploaded, the attacker requests the file directly, triggering execution by the PHP interpreter. This grants command execution with the privileges of the web server process, typically leading to full compromise of the WordPress installation.

The attack requires network access and low privileges. Any user who can register or enroll as a student on a vulnerable WPLMS site can trigger the flaw. No user interaction is required beyond the attacker's own upload request.

Root Cause

The root cause is missing or insufficient server-side validation on the file upload handler exposed to students. The plugin does not enforce an allowlist of safe file extensions, does not verify MIME types against expected content, and does not sanitize file names to strip executable extensions. This aligns with [CWE-434] weaknesses where trust is placed on client-supplied file metadata.

Attack Vector

An attacker first obtains a student-level account on the target WordPress site, either through open registration or course enrollment. The attacker then submits a crafted multipart HTTP POST request to the vulnerable WPLMS upload endpoint containing a PHP payload. After the plugin stores the file in the uploads directory, the attacker issues a GET request to the file's URL. PHP executes the payload, giving the attacker a web shell suitable for command execution, credential theft, database access, and lateral movement.

No verified exploit code has been published. Refer to the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2024-56052

Indicators of Compromise

Unexpected .php, .phtml, .phar, or .php7 files present under WordPress wp-content/uploads/ directories, especially subpaths owned by WPLMS.
HTTP POST requests from low-privilege authenticated sessions to WPLMS upload endpoints followed by direct GET requests to newly created files in the uploads path.
Web server processes spawning shell interpreters (sh, bash, cmd.exe) or system utilities immediately after a WPLMS upload request.
Outbound network connections from the WordPress host to unfamiliar IP addresses following student account activity.

Detection Strategies

Monitor WordPress uploads directories for creation of files with executable extensions and flag any deviation from the expected media file allowlist.
Correlate WPLMS request logs with file system events to identify uploads immediately followed by direct HTTP access to the uploaded artifact.
Alert on PHP-FPM or Apache child processes executing OS commands or writing to wp-config.php and other sensitive files.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root and plugin directories.
Aggregate WordPress access logs, PHP error logs, and WAF telemetry in a centralized data lake for cross-source hunting.
Track newly created student accounts followed by upload activity within short time windows.

How to Mitigate CVE-2024-56052

Immediate Actions Required

Update the WPLMS plugin to a version later than 1.9.9.5.2 as soon as a patched build is available from VibeThemes.
Audit wp-content/uploads/ for unexpected PHP files and remove any web shells identified during triage.
Review recently created student accounts and revoke access for accounts that show upload activity followed by file access requests.
Rotate WordPress administrator credentials, database passwords, and API keys stored in wp-config.php if compromise is suspected.

Patch Information

VibeThemes addresses the vulnerability in WPLMS releases after 1.9.9.5.2. Consult the Patchstack Vulnerability Report for the fixed version reference and vendor guidance. Apply the update in a staging environment before promoting to production.

Workarounds

Disable the WPLMS plugin until a patched version is deployed if immediate updating is not feasible.
Restrict PHP execution within the WordPress uploads directory using web server configuration to prevent uploaded files from being interpreted.
Deploy a web application firewall rule that blocks multipart uploads containing PHP shebangs or <?php tokens to WPLMS endpoints.
Temporarily disable open student registration and require manual approval for new accounts.

bash

# Apache: block PHP execution in WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|pht)$">
    Require all denied
</FilesMatch>

# Nginx: add to server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php7|pht)$ {
    deny all;
    return 403;
}