CVE-2020-24186: wpDiscuz plugin unauthenticated file upload leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS score of 10, public exploit code, and an EPSS probability above 0.94 makes this an urgent patch.

What it is

The gVectors wpDiscuz plugin for WordPress, versions 7.0 through 7.0.4, exposes the wmuUploadFiles AJAX action without requiring authentication and without restricting file types. An attacker can upload a PHP file and execute it on the server, giving full control of the WordPress host.

Impact

An unauthenticated attacker gains remote code execution on the web server, enabling webshell deployment, data theft, and lateral movement within the hosting environment.

Attack surface

Reachable over the network through the WordPress AJAX endpoint handling wmuUploadFiles; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Public exploit code is referenced in multiple Packet Storm and Wordfence advisories, and EPSS is 0.946 with a 99.85th percentile, indicating very high likelihood of exploitation. The CVE is not listed in CISA KEV.

What to do

• Update wpDiscuz to a version later than 7.0.4, which contains the fix.
• If patching is not immediately possible, disable or remove the wpDiscuz plugin until it can be updated.
• Restrict execution of PHP files in WordPress upload directories via web server configuration.
• Deploy a web application firewall rule blocking or inspecting the wmuUploadFiles AJAX action.
• Audit the uploads directory and web root for unexpected PHP files or webshells.

Detection

• Monitor web server logs for POST requests to admin-ajax.php with the wmuUploadFiles action.
• Alert on creation of PHP files in wp-content/uploads or other writable directories.
• Scan the filesystem for webshell signatures and recently modified PHP files.
• Review outbound connections from the web server for signs of post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.