CVE-2024-28850: WP Crontrol RCE Vulnerability
Summary
CVE-2024-28850: WP Crontrol vulnerable to possible RCE when combined with a pre-condition. Affects johnbillion/wp-crontrol versions < 1.16.2. Fixed in 1.16.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WP Crontrol is a plugin for WordPress that allows administrative users to create events in the WP-Cron system to store and execute PHP code. This feature has certain security permissions to restrict unauthorized access. However, when combined with a pre-condition, such as a vulnerable SQLi or compromised database, there is a potential for remote code execution (RCE) attacks.
Vulnerability Detail
The vulnerability in WP Crontrol arises when it is targeted through vulnerability chaining with a separate SQLi or similar vulnerability. This allows an attacker to execute arbitrary PHP code on the target site. The vulnerability can be exploited if the site is vulnerable to a writeable SQLi vulnerability, the database is compromised at the hosting level, there is a method to update arbitrary options in the wp_options table, or there is a method to trigger an arbitrary action, filter, or function with control of the parameters.
How To Fix
Minimum fixed version
1.16.2
This is the first release that contains the fix.
composer require johnbillion/wp-crontrol:1.16.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability other than updating WP Crontrol to the latest version.
Conclusion
The WP Crontrol plugin is vulnerable to remote code execution (RCE) when combined with a pre-condition such as a vulnerable SQLi or compromised database. To mitigate this vulnerability, it is crucial to update WP Crontrol to version 1.16.2 or later. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for johnbillion/wp-crontrol →
FAQ
Your site is only at risk if it meets one of the preconditions mentioned and if an attacker actively exploits the vulnerability.
The vulnerability is classified as high severity due to the potential for remote code execution (RCE). However, the actual risk depends on the preconditions being met.
The difference lies in the handling of the DISALLOW_FILE_MODS and DISALLOW_FILE_EDIT constants. While those constants disable the plugin and theme editors, PHP cron events in WP Crontrol will continue to run according to their schedule.
If an attacker successfully exploits this vulnerability, they can execute arbitrary PHP code on the target site, potentially leading to further compromise or unauthorized access.
The only known mitigation is to update WP Crontrol to version 1.16.2 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for johnbillion/wp-crontrol.
