CVE-2024-6318: Wbolt Imgspider RCE Vulnerability

CVE-2024-6318 Overview

The IMGspider plugin for WordPress contains an arbitrary file upload vulnerability in the upload_img_file function. The flaw affects all versions up to and including 2.3.10. Missing file type validation allows authenticated users with contributor-level permissions or above to upload arbitrary files to the server. Successful exploitation can lead to remote code execution on the affected WordPress site. The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated contributors can upload executable files to WordPress servers, enabling remote code execution and full site compromise.

Affected Products

Wbolt IMGspider plugin for WordPress, versions up to and including 2.3.10
WordPress sites permitting contributor-level account registration
Any WordPress installation running vulnerable IMGspider builds

Discovery Timeline

2024-07-04 - CVE-2024-6318 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6318

Vulnerability Analysis

The IMGspider plugin exposes an image upload handler through the upload_img_file function defined in classes/post.class.php. The function accepts a file input from an authenticated user request and writes it to the WordPress uploads directory. It does not validate the MIME type, file extension, or content signature of the incoming file. An attacker with contributor privileges can submit a PHP file disguised as an image and receive a predictable server path in response.

Once the file is stored inside the web root, the attacker requests it directly through the browser. The web server interprets the file according to its extension and executes attacker-controlled PHP code. This results in remote code execution under the WordPress process account.

Root Cause

The upload routine trusts client-supplied data and skips server-side validation. There is no allow-list of image extensions, no verification of image headers, and no sanitization of the stored filename. The vulnerable code path writes the uploaded content directly to disk.

Attack Vector

Exploitation requires an authenticated session with contributor-level access or higher. Many WordPress sites accept contributor registrations for guest authors, which lowers the barrier to entry. The attacker submits a POST request to the plugin's upload endpoint containing a PHP payload with an image-like filename. The plugin stores the file and returns its URL. The attacker then requests the URL to trigger code execution, establish persistence, and pivot into the underlying host.

Refer to the Wordfence vulnerability report for additional technical context.

Detection Methods for CVE-2024-6318

Indicators of Compromise

Files with executable extensions such as .php, .phtml, or .phar inside wp-content/uploads/ directories associated with IMGspider
Requests to the plugin's upload_img_file handler from contributor accounts followed by direct GET requests to newly created upload paths
Unexpected outbound connections or reverse shells originating from the PHP-FPM or Apache worker process
New administrator accounts or modifications to wp-config.php shortly after a suspicious upload event

Detection Strategies

Inspect web server access logs for POST requests targeting IMGspider upload endpoints followed by GET requests to files under wp-content/uploads/ with non-image extensions
Deploy file integrity monitoring on the WordPress uploads directory to alert on creation of PHP or script files
Use a WordPress security scanner or WAF rule that detects arbitrary file upload attempts against known-vulnerable plugin endpoints

Monitoring Recommendations

Alert on process creation events where the web server user spawns shells, curl, wget, or interpreters such as python and perl
Monitor for new files under wp-content/uploads/ whose MIME type does not match their extension
Track contributor account activity, particularly uploads occurring immediately after account creation

How to Mitigate CVE-2024-6318

Immediate Actions Required

Update the IMGspider plugin to the version published in changeset 3107741, which is later than 2.3.10
Audit all contributor-level and above accounts and remove any that are not required
Review wp-content/uploads/ for unauthorized script files and remove them after preserving forensic copies
Rotate WordPress secrets in wp-config.php and reset user passwords if compromise is suspected

Patch Information

The vendor addressed the issue through a plugin update tracked in the WordPress plugin repository. The fix is documented in the WordPress plugin changeset and adds file type validation to the upload_img_file function. Site administrators should install the patched release through the WordPress admin dashboard or via WP-CLI.

Workarounds

Deactivate and remove the IMGspider plugin until the patched version can be installed
Restrict contributor registration and require administrator approval for new author accounts
Configure the web server to deny execution of PHP files inside wp-content/uploads/ using directory-level rules

bash

# Apache: block PHP execution inside the WordPress uploads directory
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php5|php7)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}