CVE-2024-56057: WPLMS WordPress Plugin RCE Vulnerability

CVE-2024-56057 Overview

CVE-2024-56057 is an arbitrary file upload vulnerability in the VibeThemes WPLMS plugin for WordPress. The flaw stems from unrestricted upload of files with dangerous types [CWE-434]. Authenticated attackers with low privileges can upload a web shell to the web server and achieve remote code execution. The vulnerability affects all WPLMS versions up to and including 1.9.9.5.2. WPLMS is a widely deployed WordPress Learning Management System used across educational and corporate training sites, expanding the potential attack surface.

Critical Impact
Authenticated attackers can upload arbitrary files, including PHP web shells, to gain remote code execution on the underlying WordPress host with full confidentiality, integrity, and availability impact.

Affected Products

VibeThemes WPLMS plugin versions prior to 1.9.9.5.2
WordPress sites running the wplms_plugin component
Learning Management System deployments built on the WPLMS theme ecosystem

Discovery Timeline

2024-12-18 - CVE-2024-56057 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56057

Vulnerability Analysis

The vulnerability is classified under [CWE-434]: Unrestricted Upload of File with Dangerous Type. The WPLMS plugin exposes a file upload endpoint that fails to validate the type, extension, or content of uploaded files. An authenticated attacker can submit a request containing a PHP file disguised as a legitimate resource. Once the file is written to a web-accessible directory, the attacker requests the file through a browser and triggers execution by the PHP interpreter. This yields arbitrary code execution in the WordPress security context.

The attack requires network access and low privileges, but no user interaction. Successful exploitation compromises the entire WordPress installation, including the database, user credentials, and any integrated services. Attackers commonly use this class of flaw to install persistent web shells, pivot to internal networks, or deploy cryptominers and ransomware.

Root Cause

The root cause is missing or insufficient server-side validation of uploaded file attributes. The plugin does not enforce an allowlist of safe file extensions or MIME types. It also fails to verify file content signatures before writing the file to disk within the WordPress uploads directory tree.

Attack Vector

Exploitation follows a standard arbitrary file upload chain. The attacker authenticates as a low-privileged user, submits a crafted multipart request to the vulnerable WPLMS endpoint, and includes a PHP payload with a bypassed extension such as .php, .phtml, or a double extension. The attacker then issues an HTTP GET request to the uploaded file path to execute the shell.

Refer to the Patchstack Vulnerability Advisory for technical details.

Detection Methods for CVE-2024-56057

Indicators of Compromise

Unexpected .php, .phtml, or .phar files in wp-content/uploads/ or WPLMS-specific upload directories
HTTP POST requests to WPLMS upload handlers followed by GET requests to newly created files in uploads/
Outbound connections from the web server process (php-fpm, apache2, nginx) to unknown IP addresses
New or modified WordPress administrator accounts created shortly after file upload activity

Detection Strategies

Monitor web server logs for POST requests to WPLMS AJAX or REST endpoints followed by requests to executable file types in upload paths
Deploy file integrity monitoring on the WordPress wp-content/uploads/ directory to flag PHP file creation
Use a web application firewall (WAF) rule set that inspects multipart uploads for PHP magic bytes and shell signatures
Correlate authentication events with subsequent file upload activity to identify low-privilege accounts abusing the endpoint

Monitoring Recommendations

Alert on any web server process spawning shell interpreters such as sh, bash, or cmd.exe
Track process lineage from PHP handlers to detect post-exploitation command execution
Log and review all plugin update activity and file writes to wp-content/ in near real time

How to Mitigate CVE-2024-56057

Immediate Actions Required

Update the WPLMS plugin to a version later than 1.9.9.5.2 as soon as the vendor releases a fixed build
Audit the wp-content/uploads/ directory tree for unauthorized PHP files and remove any web shells
Rotate WordPress administrator credentials, API keys, and database passwords if compromise is suspected
Restrict WPLMS-related user roles and disable low-privileged account self-registration where not required

Patch Information

Apply the vendor patch published by VibeThemes for WPLMS versions after 1.9.9.5.2. Consult the Patchstack Vulnerability Advisory for the current fixed release and vendor guidance.

Workarounds

Block PHP execution inside wp-content/uploads/ at the web server level using directory-scoped configuration
Deploy a WAF rule to block multipart uploads containing PHP tags or executable file extensions to WPLMS endpoints
Temporarily disable the WPLMS plugin on public-facing sites until a patched version is installed
Restrict access to WordPress admin and AJAX endpoints by source IP where operationally feasible

bash

# Apache: deny PHP execution in the WordPress uploads directory
# Place this in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
    Require all denied
</FilesMatch>

# Nginx: add to the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}