CVE-2024-9932: Wux Blog Editor WordPress RCE Vulnerability

CVE-2024-9932 Overview

CVE-2024-9932 is an unauthenticated arbitrary file upload vulnerability in the Wux Blog Editor plugin for WordPress. The flaw exists in the wuxbt_insertImageNew function and affects all versions up to and including 3.0.0. The function fails to validate file types before accepting uploads, allowing attackers to write executable PHP files to the server. Successful exploitation leads to remote code execution under the web server account. The weakness is classified as [CWE-434] Unrestricted Upload of File with Dangerous Type. A public exploit referenced as a 0-click-RCE-Exploit is hosted on GitHub, increasing the operational risk for unpatched WordPress sites.

Critical Impact
Unauthenticated remote attackers can upload arbitrary files, including PHP web shells, and execute commands on the underlying WordPress host.

Affected Products

Wux Blog Editor plugin for WordPress, versions up to and including 3.0.0
WordPress sites that have the Wux Blog Editor plugin installed and activated
Hosting environments serving the vulnerable plugin's External_Post_Editor.php endpoint

Discovery Timeline

2024-10-26 - CVE-2024-9932 published to the National Vulnerability Database
2026-04-15 - Last updated in the NVD database

Technical Details for CVE-2024-9932

Vulnerability Analysis

The vulnerability resides in the wuxbt_insertImageNew function defined in External_Post_Editor.php of the Wux Blog Editor plugin. The function accepts an image upload request but does not enforce server-side validation of file extension, MIME type, or content. An unauthenticated attacker can submit an HTTP POST request containing a PHP payload and have it written into a web-accessible directory. Once written, the attacker requests the uploaded file directly through the web server to execute arbitrary PHP code. This results in full compromise of the WordPress application and, depending on file system permissions, the underlying operating system.

Root Cause

The root cause is missing file type validation in wuxbt_insertImageNew. The handler trusts client-supplied data and writes the uploaded file to disk without verifying the extension against an allow-list, inspecting the MIME type, or validating magic bytes. The endpoint is also reachable without authentication, removing any barrier between an internet-based attacker and code execution.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted multipart HTTP POST request to the plugin endpoint that invokes wuxbt_insertImageNew, supplying a .php file rather than an image. The server stores the file in an uploads directory referenced by the plugin and returns a path the attacker can request. A public proof-of-concept is available at the GitHub CVE-2024-9932 Exploit repository, and the vulnerable source is visible in the WordPress Plugin Source Code.

No verified exploit code is reproduced here. See the linked references for technical details.

Detection Methods for CVE-2024-9932

Indicators of Compromise

POST requests to plugin endpoints invoking wuxbt_insertImageNew or referencing External_Post_Editor.php from unauthenticated sources
Files with executable extensions such as .php, .phtml, or .phar written under wp-content/uploads/ or plugin-controlled directories
New or modified PHP files in upload directories that contain functions like eval, system, passthru, or base64_decode
Outbound network connections from the www-data or PHP-FPM process to attacker-controlled hosts following plugin activity

Detection Strategies

Review web server access logs for unauthenticated POST requests targeting Wux Blog Editor endpoints, especially those returning HTTP 200 with image upload parameters
Run file integrity monitoring across wp-content/uploads/ and the plugin directory to alert on the creation of PHP files
Inspect WordPress audit logs for plugin activity originating from anonymous sessions
Correlate file creation events with subsequent GET requests to the same path, which indicates a web shell being invoked

Monitoring Recommendations

Forward Apache, Nginx, and PHP-FPM logs to a centralized SIEM and alert on PHP execution under upload directories
Monitor for child processes spawned by the web server, such as sh, bash, python, or curl, which indicate web shell activity
Track plugin inventory across WordPress fleets and flag any host running Wux Blog Editor at version 3.0.0 or earlier

How to Mitigate CVE-2024-9932

Immediate Actions Required

Deactivate and remove the Wux Blog Editor plugin from all WordPress installations until a patched version is confirmed available
Search wp-content/uploads/ and plugin directories for unauthorized PHP files and remove any artifacts identified during incident response
Rotate WordPress administrator credentials, API keys, and database passwords if any indicator of compromise is found
Place WordPress sites behind a web application firewall with rules blocking PHP file uploads to plugin endpoints

Patch Information

At the time of publication, the Wordfence Vulnerability Report identifies all versions up to and including 3.0.0 as vulnerable. Administrators should consult the plugin's repository for the latest release and apply any update that introduces server-side file type validation in wuxbt_insertImageNew. If no fixed version is published, removing the plugin is the only reliable remediation.

Workarounds

Block public access to External_Post_Editor.php at the web server or WAF layer until the plugin is removed or patched
Configure the web server to deny execution of PHP files under wp-content/uploads/ using directory-level handler restrictions
Restrict file system write permissions on upload directories to limit the impact of any future file upload flaws

bash

# Nginx: deny PHP execution within the WordPress uploads directory
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}

# Apache (.htaccess inside wp-content/uploads)
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>