CVE-2024-7484: Crmperks CRM Perks Forms RCE Vulnerability

CVE-2024-7484 Overview

CVE-2024-7484 is an arbitrary file upload vulnerability in the CRM Perks Forms plugin for WordPress. The flaw resides in the handle_uploaded_files function, which fails to properly validate uploaded file types in versions up to and including 1.1.3. Authenticated attackers with administrator-level capabilities or higher can upload arbitrary files to the affected site's server. Successful exploitation may enable remote code execution (RCE) on the underlying host. The vulnerability is classified under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated administrators can upload arbitrary files, potentially achieving remote code execution and full site compromise.

Affected Products

CRM Perks Forms plugin for WordPress, versions up to and including 1.1.3
WordPress sites with the crm-perks-forms plugin installed and active
Multi-site WordPress installations where administrators from subsites can access the plugin

Discovery Timeline

2024-08-06 - CVE-2024-7484 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7484

Vulnerability Analysis

The vulnerability exists in the handle_uploaded_files function within includes/front-form.php of the CRM Perks Forms plugin. The function processes file uploads submitted through forms rendered by the plugin, but it does not enforce a sufficient allowlist of permitted MIME types or file extensions. As a result, an attacker with administrator privileges can submit a request containing an executable file such as a PHP script and have it written to a web-accessible directory. Once the file is placed on the server, the attacker can request its URL to trigger execution under the web server user, resulting in remote code execution. Because administrator accounts on WordPress can already install arbitrary plugins, the practical impact is greatest in delegated-admin, subscription, or multi-author environments where administrator roles are held by less trusted users.

Root Cause

The root cause is insufficient file validation in the handle_uploaded_files handler. The function accepts uploaded files without rigorously checking the extension, MIME type, or magic bytes against a strict allowlist. The upstream fix, delivered in changeset 3016768, adds validation logic to reject dangerous file types before they are written to disk.

Attack Vector

Exploitation requires an authenticated session with administrator-level capabilities. The attacker submits a crafted form request that includes a file with an executable extension such as .php or a polyglot file that bypasses partial checks. The plugin writes the file to the WordPress uploads directory, after which the attacker retrieves the file over HTTP to trigger execution. Refer to the Wordfence vulnerability analysis and the vulnerable source in front-form.php for the affected code path. No public proof-of-concept exploit is currently listed for this CVE.

Detection Methods for CVE-2024-7484

Indicators of Compromise

Unexpected .php, .phtml, .phar, or other executable files appearing under wp-content/uploads/ directories written by the CRM Perks Forms plugin.
Web server access log entries showing POST requests to CRM Perks Forms endpoints followed by GET requests to newly created files in uploads paths.
New or modified WordPress administrator accounts, scheduled tasks (wp_cron), or plugin files that correlate with plugin upload activity.

Detection Strategies

Inventory WordPress installations and flag any running CRM Perks Forms plugin at version 1.1.3 or earlier.
Alert on file writes to WordPress uploads directories where the file extension matches server-executable types.
Correlate authenticated administrator activity with subsequent creation of files under uploads and follow-up requests to those files.

Monitoring Recommendations

Enable web application firewall (WAF) rules that block executable file uploads to WordPress endpoints.
Forward WordPress access logs, PHP error logs, and file integrity monitoring events to a centralized log platform for retention and correlation.
Monitor administrator authentication events for anomalies such as new admin logins from unusual geolocations or user agents preceding upload activity.

How to Mitigate CVE-2024-7484

Immediate Actions Required

Update the CRM Perks Forms plugin to a version later than 1.1.3 that includes the fix from changeset 3016768.
Audit all WordPress administrator accounts and remove or downgrade any accounts that do not require administrator privileges.
Scan the wp-content/uploads/ directory for unexpected executable files and remove any that are confirmed malicious.

Patch Information

The vendor addressed CVE-2024-7484 in a release following version 1.1.3. The fix is documented in the WordPress plugin repository at plugins.trac.wordpress.org changeset 3016768. Site owners should apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Deactivate and remove the CRM Perks Forms plugin until the patched version can be installed.
Configure the web server to deny execution of PHP files inside wp-content/uploads/ using directives in .htaccess (Apache) or a location block (nginx).
Restrict administrator role assignment to a minimal set of trusted users and enforce multi-factor authentication (MFA) on all administrator accounts.

bash

# Apache: prevent PHP execution within the WordPress uploads directory
# Place this file at wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|pht)$">
    Require all denied
</FilesMatch>

# Nginx equivalent (add inside the server block)
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}