CVE-2024-56054: WPLMS WordPress Plugin RCE Vulnerability

CVE-2024-56054 Overview

CVE-2024-56054 is an arbitrary file upload vulnerability in the VibeThemes WPLMS plugin for WordPress. The flaw allows an authenticated user with instructor-level privileges to upload files of dangerous types, including PHP web shells, to the web server. Successful exploitation grants attackers remote code execution in the context of the web server user. The vulnerability affects all versions of WPLMS up to and including 1.9.9.5.2. It is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated instructors can upload web shells to fully compromise the underlying WordPress host, exposing confidentiality, integrity, and availability of the site and its data.

Affected Products

VibeThemes WPLMS plugin (WordPress Learning Management System) versions up to and including 1.9.9.5.2
WordPress sites running the vulnerable WPLMS plugin with instructor roles enabled
Any hosting environment executing PHP files from WPLMS upload directories

Discovery Timeline

2024-12-18 - CVE-2024-56054 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56054

Vulnerability Analysis

The WPLMS plugin exposes a file upload endpoint available to users with the instructor role. The upload handler fails to validate the file extension, MIME type, or content signature against a strict allowlist. This omission enables authenticated instructors to submit PHP files or other server-executable payloads. Once written to a web-accessible directory, an attacker requests the uploaded file over HTTP to trigger execution. The result is arbitrary code execution under the web server account, with pivot potential across the WordPress database and file system.

Exploitation requires only low-level privileges because WPLMS is a learning management platform where instructor accounts are commonly provisioned or self-registered depending on site configuration. Attackers who compromise or register an instructor account can achieve full site takeover without further user interaction.

Root Cause

The root cause is missing server-side validation of user-supplied file uploads in the instructor-facing upload routine. The plugin does not restrict uploads to safe media types, does not sanitize file names, and does not block executable extensions such as .php, .phtml, or .phar. Reliance on client-side controls or weak deny-lists rather than a strict allowlist enables the bypass.

Attack Vector

The attack vector is network-based and requires authentication as an instructor. An attacker submits a crafted multipart form request to the vulnerable WPLMS upload endpoint containing a PHP payload disguised or renamed to bypass any weak filtering. After the file is stored in the WordPress uploads directory, the attacker issues a direct GET request to the uploaded file to execute the payload. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-56054

Indicators of Compromise

Presence of PHP, .phtml, .phar, or other executable files in WPLMS-related upload directories under wp-content/uploads/
Unexpected files with double extensions such as image.jpg.php in WordPress upload paths
HTTP POST requests to WPLMS instructor upload endpoints followed by GET requests to newly created files in wp-content/uploads/
Web server processes spawning shells, curl, wget, or outbound connections initiated from the PHP-FPM or Apache worker process

Detection Strategies

Monitor WordPress upload directories for newly created files whose extensions are not on an approved media allowlist.
Correlate authenticated instructor sessions with subsequent execution of files under wp-content/uploads/ in web server access logs.
Inspect wp_usermeta and wp_users tables for recently created or elevated instructor accounts that precede file upload activity.

Monitoring Recommendations

Enable web application firewall logging for POST requests to WPLMS AJAX and REST endpoints, alerting on multipart uploads containing PHP signatures.
Forward WordPress audit logs, web server access logs, and file integrity events to a centralized SIEM for correlation.
Alert on process lineage where php-fpm, httpd, or nginx spawns interactive shells or outbound network utilities.

How to Mitigate CVE-2024-56054

Immediate Actions Required

Update the WPLMS plugin to a version later than 1.9.9.5.2 as soon as the vendor patch is available.
Audit all instructor accounts and disable or reset any that are unrecognized or inactive.
Scan the WordPress installation for unauthorized PHP files in wp-content/uploads/ and remove any web shells discovered.
Rotate WordPress secret keys, database credentials, and administrative passwords if compromise is suspected.

Patch Information

Refer to the Patchstack Vulnerability Report for vendor patch status and the fixed version. Apply the vendor-supplied update through the WordPress plugin management interface once available.

Workarounds

Restrict the instructor role or disable instructor self-registration until the plugin is patched.
Configure the web server to deny execution of PHP files inside wp-content/uploads/ using directory-level rules in .htaccess, Nginx location blocks, or equivalent controls.
Deploy a web application firewall rule that blocks multipart uploads containing PHP tags or executable file extensions to WPLMS endpoints.
Enforce file integrity monitoring on the WordPress document root to alert on new executable files.

bash

# Nginx: block PHP execution in the WordPress uploads directory
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[3-8])$ {
    deny all;
    return 403;
}