CVE-2024-35661

Executive Summary

CVE-2024-35661 is a Missing Authorization vulnerability in the WordPress plugin Upload Fields for WPForms by SoftLab, affecting versions from n/a through 1.0.2. This flaw allows unauthenticated attackers to bypass authorization checks, potentially exposing sensitive uploaded file data. The vulnerability carries a CVSS score of 5.3 (Medium) and has a low EPSS probability (0.0%), indicating limited active exploitation at this time. No public proof-of-concept (PoC) or exploit code has been released, and no official patch is available from the vendor. As a WordPress ecosystem issue, this affects sites using the plugin to handle file uploads via WPForms.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the WordPress supply chain. Administrators should monitor the plugin’s update channel and consider disabling or replacing it until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The vulnerability is exploitable remotely without authentication, making it accessible to any attacker. The low confidentiality impact suggests that only limited data exposure is possible, but the lack of required privileges and user interaction increases the risk.

Deep Dive & Mechanics

The Upload Fields for WPForms plugin extends the WPForms plugin by adding custom file upload fields. The vulnerability lies in the plugin’s failure to properly enforce authorization checks when handling file uploads or accessing uploaded files. Specifically, the plugin does not verify that the user requesting access to uploaded files has the necessary permissions (e.g., being the form submitter or an administrator). This allows an unauthenticated attacker to enumerate or retrieve files uploaded via the plugin.

The missing authorization likely occurs in AJAX handlers or REST endpoints that serve uploaded files. Without proper capability checks, an attacker can craft requests to access files by guessing or enumerating file IDs or paths. The plugin version 1.0.2 and earlier are affected.

Vulnerable vs. Patched Code

Since no patched version exists, a direct comparison is not possible. However, the vulnerable code likely lacks a current_user_can() check or similar authorization mechanism. A hypothetical patch would add a capability check before serving file data.

Vulnerable Code (Hypothetical):

function serve_uploaded_file() {
    $file_id = $_GET['file_id'];
    $file_path = get_upload_path($file_id);
    readfile($file_path);
}
add_action('wp_ajax_nopriv_serve_file', 'serve_uploaded_file');

Patched Code (Hypothetical):

function serve_uploaded_file() {
    if (!current_user_can('read')) {
        wp_die('Unauthorized');
    }
    $file_id = $_GET['file_id'];
    $file_path = get_upload_path($file_id);
    readfile($file_path);
}
add_action('wp_ajax_serve_file', 'serve_uploaded_file');

Exploitation & Lab Setup

Red Team

To exploit this vulnerability in a lab environment:

1. Setup: Install WordPress with WPForms and Upload Fields for WPForms (version 1.0.2). Create a form with a file upload field and submit a test file.
2. Enumerate File IDs: Use a tool like Burp Suite or a simple script to brute-force file IDs (e.g., 1, 2, 3) in the plugin’s file-serving endpoint.
3. Exploit: Send a GET request to the vulnerable endpoint without authentication:

   GET /wp-admin/admin-ajax.php?action=serve_file&file_id=1 HTTP/1.1
   Host: target-site.com
   

   If successful, the server returns the file content.

Example cURL command:

curl -v "http://target-site.com/wp-admin/admin-ajax.php?action=serve_file&file_id=1"

Blue Team

To detect exploitation attempts:

• Monitor for repeated requests to admin-ajax.php with the action parameter set to plugin-specific actions (e.g., serve_file).
• Look for anomalous file ID enumeration patterns (sequential or random IDs).
• Check server logs for 200 responses to unauthenticated file-serving requests.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/upload-fields-for-wpforms/
• URL Patterns: /wp-admin/admin-ajax.php?action=serve_file&file_id=*
• Log Entries: Repeated admin-ajax.php requests from the same IP with varying file_id values.
• Network Traffic: HTTP GET requests to the vulnerable endpoint without authentication cookies.

Detection Engineering

YARA Rule

rule CVE_2024_35661_Upload_Fields_WPForms {
    meta:
        description = "Detects vulnerable Upload Fields for WPForms plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-35661"
    strings:
        $vuln_func = "wp_ajax_nopriv_" ascii wide nocase
        $plugin_path = "upload-fields-for-wpforms" ascii wide nocase
    condition:
        $plugin_path and $vuln_func
}

Sigma Rule

title: CVE-2024-35661 Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated access to file-serving endpoints in Upload Fields for WPForms
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - "admin-ajax.php?action=serve_file"
    condition: selection
falsepositives:
    - Legitimate plugin usage (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35661 - Upload Fields for WPForms Unauthenticated File Access"; flow:to_server; content:"GET"; http_method; content:"admin-ajax.php"; http_uri; content:"action=serve_file"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate Action: Disable the Upload Fields for WPForms plugin until a patch is released.
• Workaround: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with the action=serve_file parameter from unauthenticated users.
• Long-term: Monitor the plugin’s repository for updates. Consider replacing the plugin with an alternative that has active security maintenance.
• Hardening: Ensure WordPress and all plugins are updated to the latest versions. Use a security plugin to add additional authorization checks.

Valters IT
DevSecOps & Cyber Threat Intelligence