CVE-2024-8480 Overview
CVE-2024-8480 affects the Image Optimizer, Resizer and CDN – Sirv plugin for WordPress in all versions up to and including 7.2.7. The plugin lacks a capability check on the sirv_save_prevented_sizes function. Authenticated users with Contributor-level access or above can abuse this gap to reach the sirv_upload_file_by_chunks_callback function. That function performs no file type validation, letting attackers upload arbitrary files to the server. Successful exploitation may lead to remote code execution on the WordPress host. The issue is tracked under [CWE-862] Missing Authorization.
Critical Impact
Contributor-level accounts can upload arbitrary files to affected WordPress sites, creating a viable path to remote code execution.
Affected Products
- Sirv Image Optimizer, Resizer and CDN plugin for WordPress, versions up to and including 7.2.7
- WordPress sites running the vulnerable Sirv plugin with Contributor or higher user accounts
- Multi-author WordPress deployments where low-privilege authors can access admin-ajax.php
Discovery Timeline
- 2024-09-06 - CVE-2024-8480 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8480
Vulnerability Analysis
The Sirv plugin exposes AJAX handlers that manage image size configuration and chunked file uploads. The sirv_save_prevented_sizes handler is registered for authenticated users but omits a current_user_can() capability check. Any logged-in user, including Contributors, can invoke it and manipulate plugin state.
The adjacent sirv_upload_file_by_chunks_callback function accepts uploaded chunks and reassembles them on disk. It does not validate the uploaded file's MIME type or extension. An attacker can upload a PHP file into a web-accessible directory, then request the file to execute code in the WordPress process context.
Because the attacker only needs Contributor privileges, the barrier to exploitation is low on any site that allows guest post submissions or maintains a large author base.
Root Cause
The root cause is a missing authorization check paired with absent file type validation. The plugin trusts that authenticated requests originate from administrators and does not enforce role restrictions or filter uploaded content by extension or MIME type. See the WordPress Plugin Sirv Source Code for the vulnerable handler.
Attack Vector
The attack requires network access to the target WordPress site and valid credentials at Contributor level or above. The attacker sends a crafted POST request to admin-ajax.php invoking the vulnerable action, then uploads chunks of a PHP payload. Once the file is written to a reachable path, the attacker requests it to trigger execution.
The vulnerability manifests in the AJAX handlers sirv_save_prevented_sizes and sirv_upload_file_by_chunks_callback. Refer to the Wordfence Vulnerability Report for technical details.
Detection Methods for CVE-2024-8480
Indicators of Compromise
- Unexpected .php, .phtml, or .phar files under wp-content/uploads/ or Sirv plugin directories
- POST requests to /wp-admin/admin-ajax.php with action=sirv_save_prevented_sizes or action=sirv_upload_file_by_chunks_callback originating from Contributor accounts
- New or modified WordPress user accounts created shortly after suspicious AJAX activity
- Outbound connections from the web server to unfamiliar hosts following upload activity
Detection Strategies
- Inspect web server access logs for admin-ajax.php requests referencing the two Sirv actions from non-administrator sessions
- Alert on newly created executable files in wp-content/uploads/ and plugin directories
- Compare installed Sirv plugin version against 7.2.8 or later to identify unpatched hosts
Monitoring Recommendations
- Enable file integrity monitoring across the WordPress document root and wp-content subtree
- Forward WordPress and web server logs to a central analytics platform for correlation of authenticated uploads with subsequent PHP execution
- Track Contributor and Author account activity for anomalous AJAX request volume
How to Mitigate CVE-2024-8480
Immediate Actions Required
- Update the Sirv plugin to a version newer than 7.2.7 on every WordPress site
- Audit Contributor, Author, and Editor accounts and disable any that are inactive or unrecognized
- Review wp-content/uploads/ for unauthorized executable files and remove them
- Rotate WordPress administrator credentials and API keys if compromise is suspected
Patch Information
The vendor addressed the missing capability check and file validation in the release following 7.2.7. See WordPress Changeset #3115018 for the fix. Site operators should upgrade through the WordPress plugin dashboard or by deploying the patched release via automation.
Workarounds
- Deactivate the Sirv plugin until the patched version is deployed
- Restrict admin-ajax.php access at the web application firewall for the two vulnerable action names
- Configure the web server to deny PHP execution within wp-content/uploads/ using directory-level rules
- Temporarily downgrade Contributor accounts or disable public registration on affected sites
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
