Vulnerability record · CVE-2024-9047 · published 12 October 2024
CVE-2024-9047: WordPress File Upload plugin path traversal via wfu_file_downloader.php
Iptanus · Wordpress File Upload
The WordPress File Upload plugin is vulnerable to path traversal in all versions up to and including 4.24.11 through wfu_file_downloader.php. An unauthenticated attacker can read or delete files outside the intended directory, but only when the site runs PHP 7.4 or earlier. The flaw is critical because it allows both data exposure and destructive file deletion without credentials.
Description
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network-reachable path traversal with high confidentiality, integrity and availability impact and a very high EPSS probability, though limited to sites on PHP 7.4 or earlier.
What it is
The WordPress File Upload plugin is vulnerable to path traversal in all versions up to and including 4.24.11 through wfu_file_downloader.php. An unauthenticated attacker can read or delete files outside the intended directory, but only when the site runs PHP 7.4 or earlier. The flaw is critical because it allows both data exposure and destructive file deletion without credentials.
Impact
An attacker gains read access to arbitrary files on the server, potentially exposing configuration and credential material, and can delete files outside the intended directory, causing data loss or denial of service.
Attack surface
Reachable over the network through wfu_file_downloader.php with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The only precondition stated is that the target WordPress installation runs PHP 7.4 or earlier.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.93339 (99.833rd percentile), indicating a strong likelihood of attempted exploitation; the patch reference confirms a fix exists.
What to do
- Update the WordPress File Upload plugin beyond version 4.24.11 using the vendor changeset as the patch reference.
- Upgrade the site to a supported PHP version newer than 7.4, since exploitation requires PHP 7.4 or earlier.
- If patching is not immediately possible, disable or remove the plugin, or block access to wfu_file_downloader.php at the web server or WAF.
- Restrict file system permissions for the web server user to limit which files can be read or deleted.
- Verify backups and file integrity of the WordPress installation after any suspected exposure.
Detection
- Review web server logs for requests to wfu_file_downloader.php containing traversal sequences such as ../ or encoded variants.
- Monitor for unexpected reads or deletions of files outside the WordPress uploads directory.
- Alert on file integrity changes in WordPress core, plugin and configuration directories.
- Correlate plugin endpoint access from unauthenticated or unfamiliar source IPs with subsequent file system anomalies.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2024-9047 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-9047), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
