CVE-2024-8242: Inspireui MStore API RCE Vulnerability

CVE-2024-8242 Overview

The MStore API plugin for WordPress contains an arbitrary file upload vulnerability in the update_user_profile() function. The flaw affects all plugin versions up to and including 4.15.3. Authenticated attackers with subscriber-level access can upload arbitrary non-PHP files to the server due to missing file type validation. When combined with the plugin's user registration endpoint, unauthenticated attackers can exploit this issue to achieve remote code execution under certain server configurations. The vulnerability is tracked as [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated attackers with minimal privileges can upload arbitrary files to affected WordPress sites, potentially leading to remote code execution and full site compromise.

Affected Products

InspireUI MStore API plugin for WordPress (versions ≤ 4.15.3)
WordPress sites using MStore API to build native Android and iOS applications
Any WordPress installation with subscriber-level registration enabled and the vulnerable plugin active

Discovery Timeline

2024-09-13 - CVE-2024-8242 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8242

Vulnerability Analysis

The MStore API plugin exposes REST endpoints that allow mobile applications to interact with WordPress backends. The update_user_profile() function in controllers/flutter-user.php accepts user-supplied file uploads for profile-related operations. The function fails to validate the MIME type or file extension of uploaded content before writing it to the server's filesystem.

An attacker with subscriber-level access can call the vulnerable endpoint and upload files with dangerous extensions such as .phtml, .phar, .html, or .svg. While the code blocks .php extensions specifically, this allowlist-by-exclusion approach fails to account for alternative executable extensions that many Apache and Nginx configurations still process as PHP or serve with active content types.

Root Cause

The root cause is missing file type validation in the update_user_profile() function. The function trusts client-supplied file metadata and writes uploads directly to the web-accessible uploads directory. Because the plugin also exposes a public user registration endpoint, the barrier of authentication offers minimal protection — any anonymous attacker can register an account and then upload malicious files.

Attack Vector

An attacker first creates a subscriber account through the plugin's open registration flow. The attacker then issues an authenticated request to the profile update endpoint with a crafted multipart form containing a payload file. The server stores the file under wp-content/uploads/ where it becomes accessible over HTTP. Depending on server configuration and the presence of chained vulnerabilities, the uploaded file can be executed to achieve remote code execution. Full technical details are documented in the Wordfence Vulnerability Analysis and the WordPress Plugin Code Snippet.

Detection Methods for CVE-2024-8242

Indicators of Compromise

Unexpected files in wp-content/uploads/ with executable or scripting extensions such as .phtml, .phar, .html, or .svg containing embedded scripts
POST requests to /wp-json/api/flutter_user/update_user_profile originating from newly registered subscriber accounts
Sudden increase in new user registrations followed immediately by profile update API calls
Web shell access patterns targeting files in the uploads directory

Detection Strategies

Inspect HTTP access logs for POST requests to MStore API user endpoints followed by GET requests to unusual files under wp-content/uploads/
Correlate WordPress user creation events with subsequent file writes to the uploads directory within short time windows
Deploy web application firewall rules that inspect multipart uploads to WordPress REST API endpoints for non-image content types

Monitoring Recommendations

Enable file integrity monitoring across the WordPress webroot, prioritizing wp-content/uploads/ and plugin directories
Log and alert on all REST API calls to the /wp-json/api/flutter_user/ namespace
Track user registration rates and flag anomalous spikes that could indicate automated exploitation

How to Mitigate CVE-2024-8242

Immediate Actions Required

Update the MStore API plugin to version 4.15.4 or later on all affected WordPress installations
Audit the wp-content/uploads/ directory for suspicious files created since the plugin was installed
Review the WordPress user database for unauthorized subscriber accounts and remove any that appear malicious
Rotate WordPress administrator credentials and API keys if compromise is suspected

Patch Information

InspireUI addressed the vulnerability in the plugin repository. The fix adds file type validation to the update_user_profile() function. Review the patch details in the WordPress Plugin Changeset Log and the WordPress Plugin Functions Changeset.

Workarounds

Disable the MStore API plugin until patching is complete if the mobile application backend is not business-critical
Configure the web server to prevent execution of any file types other than static assets within the wp-content/uploads/ directory
Disable public user registration in WordPress general settings to remove the unauthenticated exploitation path
Restrict access to the /wp-json/api/flutter_user/ REST endpoints via web application firewall rules until the patch is applied

bash

# Nginx configuration to block script execution in uploads directory
location ~* /wp-content/uploads/.*\.(php|phtml|phar|html|svg)$ {
    deny all;
    return 403;
}