CVE-2024-9698: Crafthemes Demo Import RCE Vulnerability

CVE-2024-9698 Overview

CVE-2024-9698 is an arbitrary file upload vulnerability in the Crafthemes Demo Import plugin for WordPress. The flaw resides in the process_uploaded_files function, which fails to validate the type of files submitted by users. All plugin versions up to and including 3.3 are affected. Authenticated attackers holding Administrator-level access or higher can upload arbitrary files to the server. Successful exploitation may lead to remote code execution on the WordPress host. The weakness is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Administrator-level attackers can upload executable PHP files through the demo import workflow, enabling remote code execution and full site compromise.

Affected Products

Crafthemes Demo Import plugin for WordPress, versions up to and including 3.3
WordPress sites where the plugin is installed and active
Any hosting environment executing PHP files from the plugin upload directory

Discovery Timeline

2024-12-14 - CVE-2024-9698 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9698

Vulnerability Analysis

The vulnerability is an unrestricted file upload flaw in the plugin's demo import helper. The process_uploaded_files function accepts files submitted through the plugin's import workflow and writes them to a location served by the web server. The function does not enforce an allowlist of MIME types or file extensions. As a result, an attacker can substitute a PHP payload for the expected demo asset. Requesting the uploaded file then triggers PHP execution under the web server's user context. The vulnerability requires Administrator privileges, which limits opportunistic exploitation but remains valuable for attackers who have already compromised a low-tier admin account or chained it with an account takeover flaw.

Root Cause

The root cause is missing file type validation in the process_uploaded_files function at inc/Helpers.php (referenced at line 421 in the plugin trunk). Developers relied on the trusted role of the caller instead of validating file contents, extensions, or MIME types before writing to disk. See the WordPress plugin source for the affected code path.

Attack Vector

An authenticated administrator sends a crafted multipart request to the plugin's import endpoint. The request contains a PHP file disguised as a demo import asset. The plugin stores the file within the WordPress uploads directory without extension filtering. The attacker then issues an HTTP GET request to the uploaded file, causing the web server to execute the embedded PHP code and yielding remote code execution. Additional technical context is available in the Wordfence vulnerability report.

No public proof-of-concept code has been verified for this issue, so exploitation mechanics are described in prose only.

Detection Methods for CVE-2024-9698

Indicators of Compromise

Unexpected .php, .phtml, or .phar files created inside wp-content/uploads/ or plugin-specific import directories
POST requests to Crafthemes Demo Import endpoints followed by GET requests to newly created files in the uploads path
New administrator sessions initiating demo imports outside of maintenance windows
Web shell indicators such as eval(, base64_decode(, or system( inside files under the WordPress uploads tree

Detection Strategies

Monitor file creation events under wp-content/uploads/ and alert on any executable script extensions
Correlate WordPress admin authentication events with plugin import activity to spot anomalous usage
Inspect HTTP access logs for requests to uploaded files served with Content-Type: application/x-httpd-php

Monitoring Recommendations

Enable file integrity monitoring across the WordPress document root, with priority on the uploads directory
Ship WordPress and web server logs to a centralized SIEM and retain them for retrospective hunts
Alert on wp_options and active_plugins changes to identify sudden activation of the vulnerable plugin

How to Mitigate CVE-2024-9698

Immediate Actions Required

Update the Crafthemes Demo Import plugin to a version later than 3.3 once the vendor releases a fix
Deactivate and delete the plugin if it is not actively used for site provisioning
Audit all WordPress administrator accounts, remove unused accounts, and enforce multi-factor authentication
Scan the uploads directory for unauthorized PHP files and remove any confirmed web shells

Patch Information

At the time of publication, the NVD entry references the vulnerable code path in the plugin trunk but does not list a fixed release. Site owners should monitor the Wordfence advisory and the plugin's WordPress.org listing for a patched version. Until a fix is published, restrict use of the plugin or remove it.

Workarounds

Disable PHP execution inside wp-content/uploads/ using web server configuration directives
Restrict administrator access to trusted IP ranges via reverse proxy or WAF rules
Deploy a WordPress-aware web application firewall with rules that block script uploads to plugin import endpoints

bash

# Example Apache configuration to block PHP execution in the uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php[0-9])$">
        Require all denied
    </FilesMatch>
</Directory>

# Equivalent nginx configuration snippet
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}