CVE-2024-11635

CRITICAL

WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-11635 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 lab environment.

Description

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfu_ABSPATH' cookie parameter. This makes it possible for unauthenticated attackers to execute code on the server.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 8, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Iptanus File Upload

Browse nickboss / Iptanus File Upload

Default status: unaffected

CVE ListThrough 4.24.12affected

Proofs of concept

1

Repository PoCs

GitHubvigilante-1337/CVE-2024-11635Repository PoCby vigilante-13370Not analyzed5 files

1.8 MiB

GitHub
PoC details

Docker lab environments

1
GitHub

safe-lab/docker_compose.yaml

vigilante-1337/CVE-2024-11635Created Vuln labCVE-2024-11635Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a WordPress service with MariaDB, intended as a controlled lab for reproducing CVE-2024-11635.

safe-lab/docker_compose.yaml:1-42readme.md:1-107

Lab assessment

Vulnerability lab

The README explicitly states the environment is for reproducing CVE-2024-11635 in a controlled lab, and the Compose file sets up a WordPress instance with a vulnerable plugin.

readme.md:1-3readme.md:47-50
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

mariadb

database

MariaDB database service for WordPress, configured with root password 'toor' and a WordPress database/user.

safe-lab/docker_compose.yaml:4-14

exploitdev

web servervulnerable target

WordPress service with PHP 8.4 on Apache, exposed on host port 80, intended to host the vulnerable WordPress File Upload plugin.

safe-lab/docker_compose.yaml:16-30
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-11635

Supported by supplied evidence

The README describes the vulnerability as unauthenticated RCE in WordPress File Upload <= 4.24.12 via 'wfu_ABSPATH' cookie, and the lab includes a vulnerable plugin ZIP (wp-file-upload.4.24.12.zip) for installation.

readme.md:17-19readme.md:47-50safe-lab/docker_compose.yaml:1-42
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the lab.readme.md:47-50
  • After deployment, an administrator must manually install and activate the vulnerable plugin from the safe-lab directory.readme.md:52-56

Evidence-described exercise path

  1. Clone the repository and navigate to the safe-lab directory.readme.md:40-42
  2. Start the lab with 'sudo docker compose up -d'.readme.md:47-50
  3. Complete WordPress setup and install/activate the vulnerable plugin from safe-lab/.readme.md:52-56
  4. Use the provided exploit binary (./exploit) against the lab target.readme.md:40-44
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Compose file defines a standard WordPress+MariaDB stack with no privileged mode, no host volume mounts beyond named volumes, and no suspicious commands. The README explicitly warns to use the lab only in isolated environments. No behavior escaping the lab boundary is visible.

safe-lab/docker_compose.yaml:1-42readme.md:1-3readme.md:47-50
Review boundaries

What the analysis did not establish

  • The exploit binary (./exploit) is not included in the evidence packet and its behavior is uninspected.
  • The vulnerable plugin ZIP is present in the file inventory but its contents are not analyzed.
  • The lab requires manual plugin installation; the Compose file alone does not create a fully vulnerable environment.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

4