CVE-2024-6756: Social Auto Poster RCE Vulnerability

CVE-2024-6756 Overview

The Social Auto Poster plugin for WordPress contains an arbitrary file upload vulnerability in the wpw_auto_poster_get_image_path function. The flaw affects all versions up to and including 5.3.14. Authenticated attackers with Contributor-level permissions or higher can upload arbitrary files to the server. Successful exploitation can lead to remote code execution on the affected site. When chained with CVE-2024-6754, attackers with Subscriber-level access can also trigger the flaw. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Authenticated attackers can upload arbitrary files and achieve remote code execution on WordPress sites running Social Auto Poster versions 5.3.14 and earlier.

Affected Products

Wpwebinfotech Social Auto Poster plugin for WordPress
All versions up to and including 5.3.14
WordPress sites with Contributor-level or higher user registration enabled

Discovery Timeline

2024-07-24 - CVE-2024-6756 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6756

Vulnerability Analysis

The Social Auto Poster plugin exposes an arbitrary file upload flaw through its wpw_auto_poster_get_image_path function. The function processes image path inputs without validating file type or extension. An authenticated attacker can supply a crafted request that causes the plugin to write an attacker-controlled file to the web-accessible filesystem.

Because the plugin runs within the WordPress PHP execution context, uploaded PHP files can be requested directly and executed by the web server. This turns a file upload primitive into a full remote code execution vector on the WordPress host.

The base attack requires Contributor privileges. However, the plugin also contains CVE-2024-6754, which relaxes this requirement. Chaining CVE-2024-6754 with CVE-2024-6756 allows an attacker with only Subscriber-level access to exploit the file upload issue.

Root Cause

The root cause is missing server-side validation of file type, MIME type, and file extension inside the wpw_auto_poster_get_image_path function. The plugin trusts user-supplied path or upload parameters and does not enforce an allowlist of safe image extensions before writing the file to disk.

Attack Vector

Exploitation occurs over the network against the WordPress admin-ajax or plugin endpoint that invokes wpw_auto_poster_get_image_path. The attacker authenticates as a low-privileged user, submits a request referencing or uploading a malicious file such as a PHP web shell, and then requests the uploaded file via HTTP to execute arbitrary code.

The vulnerability is described in prose because no verified public proof-of-concept code has been published. Technical detail is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-6756

Indicators of Compromise

Unexpected files with executable extensions such as .php, .phtml, or .phar inside the WordPress wp-content/uploads directory tree used by the plugin.
HTTP POST requests to plugin endpoints referencing wpw_auto_poster_get_image_path from Contributor or Subscriber accounts.
New or unrecognized administrative users created shortly after suspicious upload activity.
Outbound network connections from the web server process (php-fpm, apache2, nginx) to unfamiliar hosts.

Detection Strategies

Monitor WordPress access logs for requests to admin-ajax.php invoking Social Auto Poster actions from low-privileged accounts.
Compare filesystem inventory of the uploads directory against an approved allowlist of image MIME types.
Alert on execution of PHP files located under user-writable upload paths.

Monitoring Recommendations

Enable WordPress audit logging for user role changes and post creation events by Contributor and Subscriber accounts.
Forward web server and PHP error logs to a centralized SIEM for correlation with authentication events.
Track process creation on the web host for shells spawned by the web server user, such as /bin/sh invoked by php-fpm.

How to Mitigate CVE-2024-6756

Immediate Actions Required

Update the Social Auto Poster plugin to a version later than 5.3.14 as soon as the vendor publishes a fixed release.
Audit existing WordPress user accounts and remove or downgrade unnecessary Contributor and Subscriber accounts.
Scan the wp-content/uploads directory for unexpected PHP files and remove any that are found.
Rotate WordPress administrator credentials and API keys if evidence of exploitation is present.

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry. Consult the Codecanyon plugin listing and the Wordfence Vulnerability Report for the latest fixed version guidance. Apply the vendor patch across all WordPress instances that install the plugin.

Workarounds

Disable the Social Auto Poster plugin until a patched version is installed.
Restrict user registration to trusted users and disable open Contributor or Subscriber signup.
Configure the web server to deny PHP execution inside wp-content/uploads using a directory-level rule.
Deploy a web application firewall rule that blocks requests to the wpw_auto_poster_get_image_path endpoint from non-administrative sessions.

bash

# Apache: deny PHP execution inside the WordPress uploads directory
# Place this file at wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
    Require all denied
</FilesMatch>