CVE-2024-2023

Executive Summary

CVE-2024-2023 is a directory traversal vulnerability in the WordPress plugins Folders and Folders Pro by Premio. The flaw resides in the handle_folders_file_upload function, allowing authenticated attackers with Author-level access or higher to upload arbitrary files to any directory on the server. This can lead to remote code execution if an attacker uploads a malicious PHP file to the web root. The vulnerability affects Folders up to version 3.0 and Folders Pro up to version 3.0.2. No public exploit code or patch details are currently available, but the risk is significant for WordPress sites with untrusted authors.

Supply Chain & Package Security

This vulnerability affects WordPress plugins distributed via the official WordPress Plugin Directory and third-party marketplaces. Users should verify plugin integrity by checking checksums and monitoring for unauthorized updates. The lack of a patch increases supply chain risk, as compromised plugins could be used to backdoor sites.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low EPSS score (0.0%) suggests limited active exploitation, but the potential for file upload to arbitrary directories makes this a serious integrity threat.

Deep Dive & Mechanics

The vulnerability exists in the handle_folders_file_upload function, which processes file uploads for the Folders plugin. The function fails to properly sanitize the destination parameter, allowing an attacker to traverse directories using ../ sequences. By crafting a request with a manipulated destination path, an authenticated user with Author privileges can upload files to arbitrary locations, such as the WordPress root directory or wp-content/uploads/.

Root Cause: Insufficient validation of the file path in the upload handler. The plugin does not restrict the destination to the intended upload directory.

Attack Flow:

1. Attacker authenticates as an Author or higher.
2. Sends a POST request to the plugin's AJAX endpoint with a file and a manipulated destination parameter (e.g., ../../wp-content/plugins/).
3. The plugin writes the file to the attacker-specified directory.
4. If the file is a PHP web shell, the attacker can execute arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (Folders <= 3.0 / Folders Pro <= 3.0.2):

function handle_folders_file_upload() {
    $file = $_FILES['file'];
    $destination = $_POST['destination'];
    move_uploaded_file($file['tmp_name'], $destination . '/' . $file['name']);
}

Patched Code (Hypothetical fix):

function handle_folders_file_upload() {
    $file = $_FILES['file'];
    $destination = $_POST['destination'];
    $allowed_dir = WP_CONTENT_DIR . '/uploads/folders/';
    $real_dest = realpath($allowed_dir . '/' . $destination);
    if (strpos($real_dest, $allowed_dir) !== 0) {
        wp_die('Invalid destination.');
    }
    move_uploaded_file($file['tmp_name'], $real_dest . '/' . basename($file['name']));
}

The patched version uses realpath() and checks that the resolved path starts with the allowed base directory, preventing directory traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Folders or Folders Pro installed (vulnerable version).
• Author-level account credentials.

Exploit Steps:

1. Log in as an Author.
2. Craft a POST request to the AJAX endpoint (e.g., /wp-admin/admin-ajax.php?action=folders_file_upload).
3. Include a file (e.g., shell.php) and set destination to ../../wp-content/.
4. The file will be uploaded to wp-content/shell.php.
5. Access the shell to execute commands.

Example cURL command:

curl -X POST \
  -F "action=folders_file_upload" \
  -F "destination=../../wp-content/" \
  -F "file=@shell.php" \
  -b "wordpress_logged_in_xxx=..." \
  http://target/wp-admin/admin-ajax.php

Blue Team

Detection:

• Monitor for unusual file uploads to non-standard directories.
• Check for ../ sequences in POST parameters.
• Alert on file creation in wp-content/ or wp-admin/ by Author-level users.

Hunting:

• Search for files named shell.php, cmd.php, or similar in unexpected locations.
• Review server access logs for POST requests to admin-ajax.php with action=folders_file_upload.

Indicators of Compromise (IOCs)

• File Paths: wp-content/shell.php, wp-content/uploads/evil.php
• Network: POST requests to /wp-admin/admin-ajax.php with parameter action=folders_file_upload and destination containing ../
• Logs: PHP error logs showing move_uploaded_file() calls with suspicious paths.
• User Agents: Unusual or automated user agents during file uploads.

Detection Engineering

YARA Rule

rule CVE_2024_2023_WordPress_Folders_Traversal {
    meta:
        description = "Detects directory traversal attempts in Folders plugin uploads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-2023"
    strings:
        $traversal = /\.\.\// nocase
        $upload_action = "folders_file_upload"
    condition:
        $upload_action and #traversal > 0
}

Sigma Rule

title: CVE-2024-2023 WordPress Folders Directory Traversal
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects directory traversal attempts in Folders plugin file uploads
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=folders_file_upload'
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-2023 WordPress Folders Directory Traversal";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"action=folders_file_upload"; http_uri;
    content:".."; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the Folders and Folders Pro plugins until a patch is available.
2. Workaround: Restrict Author-level users from uploading files via custom code or a security plugin.
3. Patch: Apply vendor update when released. Monitor the Premio plugin page for patches.
4. Hardening: Use a Web Application Firewall (WAF) to block ../ patterns in POST parameters.
5. Monitoring: Enable logging for file uploads and review for suspicious activity.

Valters IT
Securing Digital Frontiers