CVE-2024-6319: Wbolt IMGspider RCE Vulnerability

CVE-2024-6319 Overview

CVE-2024-6319 affects the IMGspider plugin for WordPress, a content aggregation plugin developed by wbolt. The vulnerability stems from missing file type validation in the upload function within classes/post.class.php. Authenticated attackers holding contributor-level permissions or above can upload arbitrary files to the affected site's server. Successful exploitation may lead to remote code execution on the WordPress host. All plugin versions up to and including 2.3.10 are impacted. The issue is classified as [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Contributor-level accounts can upload PHP or other executable files, enabling webshell installation and full site compromise.

Affected Products

wbolt IMGspider plugin for WordPress, all versions through 2.3.10
WordPress installations exposing the plugin's upload handler
Sites permitting contributor-level or higher registration

Discovery Timeline

2024-07-04 - CVE-2024-6319 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6319

Vulnerability Analysis

The IMGspider plugin exposes an upload function that accepts files submitted by authenticated WordPress users. The function fails to validate MIME types, file extensions, or file contents before writing uploaded data to disk. Attackers with contributor-level accounts can therefore submit PHP scripts, .phtml files, or other executable server-side content. Once written under the WordPress uploads directory, the attacker can request the file directly and execute arbitrary code in the web server context. This chain converts a low-privilege account into full remote code execution on the host.

Root Cause

The root cause is missing input validation on the file upload path in classes/post.class.php around line 189 of tag 2.3.10. The handler trusts client-supplied file metadata and does not enforce an allow-list of extensions or verify content against expected image formats. This maps directly to [CWE-434] Unrestricted Upload of File with Dangerous Type. See the WordPress Plugin Code Reference for the vulnerable code.

Attack Vector

Exploitation requires an authenticated session with contributor-level permissions or higher. The attacker sends a crafted multipart request to the plugin's upload endpoint containing a PHP payload disguised as an image or supplied with an executable extension. Because no server-side validation is performed, the file is written to the uploads directory. The attacker then issues an HTTP request to the uploaded file to trigger code execution. On sites allowing open registration or with weak account controls, this vector is broadly reachable across the network.

No verified proof-of-concept code is available. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-6319

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) inside wp-content/uploads/ paths written by the IMGspider plugin
HTTP POST requests to IMGspider upload endpoints originating from contributor accounts
Outbound connections from the web server process shortly after upload activity, indicating webshell callbacks
New or modified WordPress user accounts at contributor level or above preceding upload events

Detection Strategies

Inspect web server access logs for POST requests to IMGspider handlers followed by direct GET requests to newly created files under wp-content/uploads/
Monitor the WordPress uploads directory for files whose extensions do not match image MIME types
Correlate wp_users and wp_usermeta changes with subsequent plugin upload activity

Monitoring Recommendations

Alert on PHP interpreter execution originating from files under wp-content/uploads/ on the web server host
Track file creation events in uploads directories and flag non-image extensions for review
Review authentication logs for contributor-level logins from unfamiliar IP ranges or automated user agents

How to Mitigate CVE-2024-6319

Immediate Actions Required

Update the IMGspider plugin to a version later than 2.3.10 that includes the fix from WordPress Plugin Changeset 3107741
Audit all WordPress accounts at contributor level and above, removing unused or suspicious users
Scan wp-content/uploads/ for unauthorized executable files and remove any confirmed webshells
Rotate WordPress secrets, database credentials, and administrator passwords if compromise is suspected

Patch Information

The vendor addressed the missing file type validation in the changeset published at plugins.trac.wordpress.org/changeset/3107741. Site owners should upgrade to the patched release through the WordPress plugin updater or by replacing the plugin directory with the current version.

Workarounds

Deactivate and remove the IMGspider plugin until the site can be upgraded to a fixed release
Restrict contributor registration and disable open user registration in WordPress settings
Configure the web server to deny PHP execution within wp-content/uploads/ using directory-level rules
Deploy a web application firewall rule blocking executable file extensions in requests to IMGspider upload endpoints

bash

# Example Apache configuration to block PHP execution in uploads
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
        Require all denied
    </FilesMatch>
    php_flag engine off
</Directory>