CVE-2024-31210

What it actually does

Allows an administrative user to submit a non-zip file as a plugin upload; when FTP credentials are prompted for installation and DISALLOW_FILE_EDIT is true, the file remains accessible in the media library enabling arbitrary PHP execution for users otherwise restricted from such actions.

Why it matters to the business

May permit restricted administrator accounts to achieve full site control on affected WordPress installations, increasing risk of unauthorized changes, data exposure, or persistent compromise especially on sites with file modification restrictions enabled.

How an attack unfolds

An attacker logs in with administrator or super-admin rights, submits a crafted non-zip file through the plugin upload interface, triggers the FTP credential flow that leaves the file in the media library, and then executes the uploaded PHP code to bypass intended restrictions on arbitrary code execution.

How to fix it

Upgrade to WordPress 6.4.3 or any of the backported fixed releases (6.3.3, 6.2.4, 6.1.5, 6.0.7, 5.9.9, 5.8.9, 5.7.11, 5.6.13, 5.5.14, 5.4.15, 5.3.17, 5.2.20, 5.1.18, 5.0.21, 4.9.25, 4.7.28, 4.6.28, 4.5.31, 4.4.32, 4.3.33, 4.2.37, 4.1.40); alternatively define DISALLOW_FILE_MODS as true to block all plugin uploads.

How to confirm the fix worked

Confirm the installed WordPress version matches a listed fixed release or contains the referenced commits; test the upload plugin flow to ensure non-zip files are rejected before any temporary storage occurs.

Typical attack path

1. Log in with administrator or super-admin privileges on a single-site or multisite installation
2. Access the Plugins > Add New > Upload Plugin interface
3. Submit a file that is not a valid zip archive containing PHP code
4. Trigger the FTP credential prompt during attempted installation
5. Locate and invoke the file now stored in the media library to execute code

How to detect it

Inspect the media library for files uploaded outside normal plugin flows, review web server and WordPress logs for plugin upload events that coincide with FTP prompts, and search for unexpected PHP files appearing after administrator plugin activity.

What your security team should do

• Apply the appropriate WordPress update across all instances without delay
• Audit current DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and enforce the stricter constant where possible
• Review administrator accounts and reduce unnecessary privileges on sites that require FTP for updates