CVE-2024-6311: Funnelforms Free RCE Vulnerability

CVE-2024-6311 Overview

CVE-2024-6311 is an arbitrary file upload vulnerability in the Funnelforms Free plugin for WordPress. The flaw resides in the af2_add_font function, which fails to validate file types before writing uploaded content to disk. All plugin versions up to and including 3.7.3.2 are affected. Authenticated attackers holding administrator-level or higher permissions can upload arbitrary files to the web server. Successful exploitation can lead to remote code execution on the underlying host. The issue is tracked under [CWE-434] (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Authenticated administrators can upload arbitrary files through the font upload handler, enabling remote code execution and full site takeover.

Affected Products

Funnelforms Free plugin for WordPress, versions * through 3.7.3.2
WordPress sites running the vulnerable formularbuilder_fonts.php handler
Environments patched in Funnelforms Free 3.7.4.1 and later

Discovery Timeline

2024-08-28 - CVE-2024-6311 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-6311

Vulnerability Analysis

The vulnerability originates in the af2_add_font AJAX handler defined in admin/menu_ajax_functions/formularbuilder_fonts.php. The function accepts uploaded font files but does not enforce a file extension or MIME type allowlist before persisting them to the WordPress uploads directory. Because the handler trusts the client-supplied filename, an attacker can substitute a PHP script for a legitimate font file. Once written under the webroot, the file becomes reachable and executable by the PHP interpreter. This yields code execution in the context of the web server user. The vendor addressed the flaw in 3.7.4.1 by adding a file type check to the upload path.

Root Cause

The root cause is missing server-side validation of the uploaded file. The plugin relies on the request context alone and never inspects the file extension, MIME type, or content signature. Combined with placement inside a publicly reachable uploads directory, the missing validation converts an administrative feature into an execution primitive.

Attack Vector

Exploitation requires an authenticated session with administrator or higher privileges on the target WordPress site. The attacker issues a crafted AJAX request to the af2_add_font action, supplying a .php payload in place of a font file. After upload, the attacker requests the file's URL to trigger PHP execution. The attack is network-reachable and does not require user interaction.

No public proof-of-concept is referenced in the CVE data. For source-level detail, see the WordPress FunnelForms Code Review and the fixed revision in the WordPress FunnelForms Revision History.

Detection Methods for CVE-2024-6311

Indicators of Compromise

New files with executable extensions (.php, .phtml, .phar) inside the Funnelforms fonts upload directory under wp-content/uploads/
POST requests to admin-ajax.php invoking the af2_add_font action followed by direct GET requests to the uploaded filename
Unexpected outbound connections or shell command execution originating from the PHP-FPM or web server process

Detection Strategies

Monitor WordPress access logs for admin-ajax.php?action=af2_add_font requests correlated with subsequent access to newly created files in the uploads path
Scan the uploads directory for files whose extensions do not match the expected font types (.ttf, .otf, .woff, .woff2)
Alert on Funnelforms Free plugin versions <= 3.7.3.2 reported by WordPress asset inventory scans

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ and flag creation of non-media file types
Forward WordPress and web server logs to a centralized platform and build detection rules on the af2_add_font action name
Audit administrator account activity and enforce alerting on session anomalies for privileged users

How to Mitigate CVE-2024-6311

Immediate Actions Required

Upgrade Funnelforms Free to version 3.7.4.1 or later on every WordPress site running the plugin
Rotate credentials and session tokens for all administrator accounts if the plugin was internet-exposed prior to patching
Review the wp-content/uploads/ directory for suspicious executable files and remove any that are not legitimate media assets

Patch Information

The vendor released the fix in Funnelforms Free 3.7.4.1. The patched revision adds file type validation to the af2_add_font handler. Review the diff in the WordPress FunnelForms Revision History and the corresponding Wordfence Vulnerability Report.

Workarounds

Deactivate and remove the Funnelforms Free plugin until patching is complete
Restrict administrative access to the WordPress /wp-admin/ path by source IP where feasible
Configure the web server to deny PHP execution inside wp-content/uploads/ using directory-level rules

bash

# Apache: block PHP execution under wp-content/uploads
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>

# Nginx: add inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}