Full Report
The vulnerabilities, now patched, posed significant risks, including unauthorized file uploads, privilege escalation and SQL injection attacks
Analysis Summary
# Vulnerability: Critical Flaws in WordPress Plugins WPLMS and VibeBP Leading to RCE, Privilege Escalation, and SQLi
## CVE Details
- CVE ID: CVE-2024-56046, CVE-2024-56043, CVE-2024-56042 (Multiple critical vulnerabilities reported)
- CVSS Score: Not explicitly stated, but designated as "critical" severity.
- CWE: Arbitrary File Upload, Privilege Escalation, SQL Injection.
## Affected Systems
- Products: WordPress Plugins WPLMS and VibeBP (components of the WPLMS premium LMS theme).
- Versions: Prior to WPLMS version 1.9.9.5.3 and VibeBP version 1.9.9.7.7.
- Configurations: Functionalities including registration forms and REST API endpoints were targeted.
## Vulnerability Description
Researchers identified 18 vulnerabilities across the WPLMS and VibeBP plugins. The most critical issues include:
1. **Arbitrary File Upload (e.g., CVE-2024-56046):** Allowed attackers to upload malicious files, potentially leading to Remote Code Execution (RCE).
2. **Privilege Escalation (e.g., CVE-2024-56043):** Enabled unauthenticated or low-privileged users to elevate their roles to site administrator.
3. **SQL Injection (e.g., CVE-2024-56042):** Permitted attackers to execute malicious SQL queries to expose sensitive database information.
## Exploitation
- Status: Patched, but implied high risk prior to updates. Exploitation status in the wild is not confirmed, but the nature of the flaws suggests high exploitability.
- Complexity: Likely Low/Medium, given the severity and target (common WordPress plugins).
- Attack Vector: Network (via web interface/API interaction).
## Impact
- Confidentiality: High (due to potential data exposure via SQLi).
- Integrity: High (due to potential RCE and unauthorized database modification).
- Availability: High (due to potential site takeover/RCE leading to downtime).
## Remediation
### Patches
- WPLMS: Update to version **1.9.9.5.3** or later.
- VibeBP: Update to version **1.9.9.7.7** or later.
### Workarounds
No specific workarounds were detailed, but general best practices implemented by the vendor include:
* Limiting uploadable file types and adding permission checks for file uploads.
* Enforcing role restrictions and using whitelists for registration processes.
* Escaping user inputs and favoring prepared statements in all SQL queries.
## Detection
- Indicators of Compromise: Unusual files appearing in web-accessible directories (if RCE occurred), unexpected administrator accounts, or high-volume unexpected database queries.
- Detection methods and tools: Monitoring file upload functionality endpoints for suspicious file types being uploaded. Auditing database logs for injection attempts.
## References
- Vendor advisories: Issued by the WPLMS/VibeBP developers following PatchStack reporting.
- Relevant links - defanged:
- hxxps://www.infosecurity-magazine.com/news/flaws-wordpress-plugins-wplms/