CVE-2024-7626: WP Delicious Plugin RCE Vulnerability

CVE-2024-7626 Overview

CVE-2024-7626 affects the WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) for WordPress. The plugin fails to properly validate file paths in the save_edit_profile_details() function across all versions up to and including 1.6.9. Authenticated attackers with subscriber-level access or above can move arbitrary files on the server and read sensitive files. Moving files such as wp-config.php can lead to remote code execution. The flaw is tracked under CWE-73: External Control of File Name or Path.

Critical Impact
Authenticated attackers with subscriber-level access can move and read arbitrary files, including wp-config.php, enabling remote code execution and exposure of database credentials.

Affected Products

WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
All versions up to and including 1.6.9
WordPress installations with the plugin enabled

Discovery Timeline

2024-09-11 - CVE-2024-7626 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7626

Vulnerability Analysis

The vulnerability resides in the save_edit_profile_details() function within class-delicious-recipes-form-handler.php. This function handles user profile updates from the plugin's front-end dashboard. It processes file paths supplied through user-controlled input without adequate validation. Attackers can supply crafted path values that reference files outside the intended profile directory.

Because the function accepts requests from any authenticated user, including subscribers, the attack surface extends to any registered WordPress account. Subscriber accounts are commonly created through open registration on food blogs using this plugin, lowering the barrier for exploitation.

Root Cause

The root cause is insufficient file path validation on user-supplied input passed to file movement and read operations. The plugin trusts path parameters submitted with the profile edit form and does not restrict operations to a safe base directory. Path traversal sequences allow the underlying file operations to target arbitrary locations within the WordPress installation.

Attack Vector

An attacker registers or uses an existing subscriber account on the target WordPress site. The attacker then submits a crafted request to the profile edit handler with a manipulated file path parameter. The plugin executes the file operation using the attacker-controlled path, allowing arbitrary file movement or reading.

Moving wp-config.php to a web-accessible location with a readable extension exposes database credentials and authentication keys. Relocating the file can also disrupt WordPress initialization, and in certain configurations, enables replacement with attacker-controlled content leading to remote code execution.

The vulnerable code paths are documented in the WordPress plugin source code at line 260 and line 355.

Detection Methods for CVE-2024-7626

Indicators of Compromise

Unexpected relocation, renaming, or absence of wp-config.php and other WordPress core files.
HTTP POST requests to the WP Delicious profile edit endpoint containing path traversal sequences such as ../ in file path parameters.
Subscriber accounts submitting profile update requests with unusual file parameters or referencing paths outside the uploads directory.
New or modified PHP files in the WordPress web root that correlate with subscriber account activity.

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php or profile handler endpoints from subscriber-level users with path parameters containing directory separators.
Monitor WordPress file integrity for wp-config.php and other sensitive files using file integrity monitoring tools.
Correlate authentication events with subsequent file system changes to identify low-privilege accounts triggering high-impact operations.

Monitoring Recommendations

Enable WordPress audit logging plugins to capture user profile update actions and associated parameters.
Alert on any modification, move, or read operation against wp-config.php, .htaccess, and files in wp-includes/ and wp-admin/.
Track new subscriber registrations followed within a short window by profile edit submissions.

How to Mitigate CVE-2024-7626

Immediate Actions Required

Update the WP Delicious plugin to a version later than 1.6.9 that contains the fix applied in changeset 3148996.
Audit all subscriber-level and higher accounts for unauthorized registrations and remove suspicious users.
Verify the integrity of wp-config.php and rotate database credentials, AUTH_KEY, SECURE_AUTH_KEY, and other salts if compromise is suspected.
Review web root and uploads directories for unexpected PHP files and remove any unauthorized artifacts.

Patch Information

The vendor addressed the vulnerability in the plugin changeset 3148996, which introduces path validation in class-delicious-recipes-form-handler.php. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Disable the WP Delicious plugin until the update is applied.
Restrict user registration and set the default new user role to a level below subscriber where feasible.
Deploy a web application firewall rule to block requests to the plugin's profile handler that contain path traversal sequences.
Enforce filesystem permissions that prevent the web server user from writing to WordPress core directories.

bash

# Configuration example
# Restrict WordPress core file permissions to prevent unauthorized writes
chmod 400 /var/www/html/wp-config.php
chown root:www-data /var/www/html/wp-config.php
find /var/www/html/ -type d -exec chmod 755 {} \;
find /var/www/html/ -type f -exec chmod 644 {} \;