CVE-2024-9307: Themelooks Mfolio RCE Vulnerability

CVE-2024-9307 Overview

CVE-2024-9307 affects the mFolio Lite plugin for WordPress, developed by Themelooks. The plugin fails to enforce capability checks on its file upload functionality in all versions up to and including 1.2.1. Authenticated attackers with Author-level access or higher can upload arbitrary files, including SVG files containing embedded scripts and Windows executables. Successful exploitation enables stored cross-site scripting through malicious SVG payloads and potential remote code execution if an attacker or site visitor executes the uploaded .exe file. The flaw is categorized as an Unrestricted Upload of File with Dangerous Type weakness [CWE-434].

Critical Impact
Authenticated attackers can upload malicious SVG or executable files, enabling stored XSS and paths to remote code execution on the affected WordPress site.

Affected Products

Themelooks mFolio Lite plugin for WordPress
All versions up to and including 1.2.1
WordPress sites permitting Author-level or higher registration

Discovery Timeline

2024-11-06 - CVE-2024-9307 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9307

Vulnerability Analysis

The vulnerability resides in the mFolio Lite plugin's file upload handler, which processes uploads without validating whether the requesting user holds an appropriate capability. WordPress relies on capability checks such as current_user_can() to gate privileged actions. When these checks are absent, authenticated users inherit access to functionality intended for administrators. In mFolio Lite, this exposes an upload endpoint accessible to any user with Author-level access or higher.

The plugin also fails to restrict file types on the server side. Attackers can upload SVG files containing embedded JavaScript, which executes in the browser when a user views the file. Attackers can additionally upload Windows executable files, which persist on the server and can be delivered to victims via direct URL access.

Root Cause

The root cause is a missing capability check combined with insufficient file type validation in the plugin's upload routine. The upload handler does not verify user privileges before accepting the request and does not restrict MIME types or file extensions against a strict allowlist. This aligns with the [CWE-434] Unrestricted Upload of File with Dangerous Type weakness.

Attack Vector

The attack requires network access to the WordPress site and authenticated Author-level (or higher) credentials. An attacker authenticates to the WordPress admin area, invokes the vulnerable upload action, and submits a crafted SVG or .exe file. The uploaded SVG triggers script execution in the context of any user rendering the file, enabling stored XSS. The uploaded executable can be used as a payload staging location, with remote code execution possible if the file is executed on the server or downloaded and run by a victim.

Refer to the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the corrective code changes.

Detection Methods for CVE-2024-9307

Indicators of Compromise

Unexpected .svg files in wp-content/uploads/ containing <script> tags or event-handler attributes such as onload=
Presence of .exe files in WordPress upload directories where executables are not expected
New or modified files with recent timestamps under wp-content/uploads/ that do not correspond to legitimate media uploads
WordPress audit logs showing file uploads originating from Author-level accounts

Detection Strategies

Scan the wp-content/uploads/ directory for SVG files and inspect their contents for embedded scripts
Monitor WordPress access logs for POST requests to the mFolio Lite upload endpoint from non-administrator accounts
Correlate authentication events for Author-level accounts with subsequent file upload activity
Deploy web application firewall rules that block SVG and executable file uploads to WordPress

Monitoring Recommendations

Enable WordPress activity logging to capture user role, action, and uploaded filename metadata
Alert on any executable file extensions (.exe, .dll, .bat, .ps1) written to web-accessible directories
Review Author and Contributor account creation trends for signs of registration abuse
Track outbound requests from the web server to uncommon destinations following upload events

How to Mitigate CVE-2024-9307

Immediate Actions Required

Update the mFolio Lite plugin to a version later than 1.2.1 that includes the capability check fix
Audit Author-level and higher accounts, disabling any that are unrecognized or inactive
Remove any suspicious SVG or executable files discovered in wp-content/uploads/
Rotate credentials for WordPress users with elevated privileges

Patch Information

Themelooks addressed the issue in a subsequent release of mFolio Lite. The corrective changes are visible in the WordPress Plugin Changeset. Administrators should apply the update through the WordPress plugin dashboard or by downloading the latest release from the mFolio Lite plugin page.

Workarounds

Deactivate and remove the mFolio Lite plugin until the patched version can be applied
Restrict WordPress user registration and demote unnecessary Author-level accounts to Subscriber
Configure the web server to deny execution and direct access to .exe files under wp-content/uploads/
Disable SVG uploads at the WordPress level using an allowlist of safe MIME types

bash

# Example nginx configuration to block execution and downloads of dangerous file types in uploads
location ~* /wp-content/uploads/.*\.(exe|dll|bat|ps1|sh)$ {
    deny all;
    return 403;
}

location ~* /wp-content/uploads/.*\.svg$ {
    add_header Content-Security-Policy "script-src 'none'; object-src 'none'";
    add_header X-Content-Type-Options "nosniff";
}