CVE-2024-13342: 
WordPress vulnerability analysis and mitigation

CVE-2024-13342 is an arbitrary file upload vulnerability in the Booster for WooCommerce plugin for WordPress, caused by missing file type validation in the add_files_to_order function. It affects all versions up to and including 7.2.4 and was published on August 29, 2025. The flaw allows unauthenticated attackers to upload files with double extensions, potentially enabling remote code execution on susceptible server configurations. It carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, ENISA EUVD).

The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the add_files_to_order function in class-wcj-checkout-files-upload.php does not validate the type or extension of uploaded files before saving them to the server (Wordfence, WordPress Trac). An unauthenticated attacker can submit a file with a double extension (e.g., shell.php.jpg) during the WooCommerce checkout file upload process. Exploitation is conditional: it requires a server configuration that executes the first extension in a double-extension filename (e.g., Apache mod_mime misconfigurations), making it environment-dependent rather than universally exploitable (ZeroPath).

Successful exploitation can result in complete compromise of the affected WordPress installation, including remote code execution, unauthorized access to sensitive data, malware deployment, and site defacement (Wordfence). Because no authentication is required, the attack surface is broad — any publicly accessible WooCommerce checkout page with the file upload feature enabled is potentially exposed. Lateral movement within the hosting environment is also possible if the web server process has elevated filesystem permissions (ZeroPath).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.111%, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for a specific server configuration that executes the first extension of a double-extension file (ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running Booster for WooCommerce ≤ 7.2.4 with the checkout file upload feature enabled, using tools like WPScan or by inspecting plugin metadata on publicly accessible sites.
2. Identify upload endpoint: Navigate to a WooCommerce checkout page and locate the file upload field associated with the add_files_to_order function.
3. Craft malicious file: Prepare a PHP web shell with a double extension (e.g., shell.php.jpg) to bypass any basic extension blacklisting.
4. Upload the file: Submit the crafted file via the checkout file upload form without any authentication. The plugin saves the file to the server without validating its type.
5. Determine file path: Identify the upload directory (typically within wp-content/uploads/) where the file was stored, either through error messages, directory listing, or prior knowledge of the plugin's storage conventions.
6. Trigger execution: On a vulnerable server configuration (e.g., Apache with mod_mime handling double extensions), send an HTTP GET request to the uploaded file's URL to execute the PHP payload and achieve remote code execution (ZeroPath, WordPress Trac).

• Network: Unexpected HTTP POST requests to WooCommerce checkout endpoints containing multipart file uploads with double-extension filenames (e.g., .php.jpg, .php.png); outbound connections from the web server process to unknown external IPs following a file upload event.
• File System: Presence of files with double extensions (e.g., *.php.jpg) in wp-content/uploads/ or plugin-specific upload directories; newly created PHP files in upload directories that are not part of normal WordPress operation.
• Logs: Web server access logs showing POST requests to checkout pages followed shortly by GET requests to files in upload directories; PHP error logs indicating execution of uploaded scripts.
• Process: Unusual child processes spawned by the web server (e.g., php, /bin/sh, curl, wget) not associated with normal WordPress activity (ZeroPath).

Update the Booster for WooCommerce plugin to version 7.2.5 or later, which addresses the missing file type validation (WordPress Trac). If immediate patching is not feasible, disable the checkout file upload feature within the plugin settings to eliminate the attack surface. As a server-level defense, configure the web server to prevent execution of files in upload directories and to handle double-extension files safely (e.g., disable mod_mime AddHandler directives for upload paths in Apache). Implement strict server-side file type validation and consider using a Web Application Firewall (WAF) to block malicious upload attempts (Wordfence).

Wordfence published the vulnerability in their weekly WordPress vulnerability report for the week of August 25–31, 2025, highlighting it as a critical unauthenticated file upload issue (Wordfence Blog). ZeroPath published a dedicated technical blog post analyzing the vulnerability mechanics (ZeroPath). Social media activity was limited, with brief mentions on Mastodon by security aggregators such as RedPacketSecurity.