WordPress ajax-extend plugin <= 1.0 - Remote Code Execution (RCE) vulnerability

The impact of this RCE vulnerability is severe. An attacker exploiting this flaw can execute arbitrary code on the affected WordPress server with the privileges of the web server user. This could lead to complete system compromise, including data exfiltration, malware installation, and defacement of the website. The attacker could potentially gain access to sensitive data stored on the server, including user credentials, database information, and configuration files. Given the plugin's functionality (likely extending AJAX capabilities), an attacker could leverage this to manipulate website functionality and potentially pivot to other systems on the network.

Websites using the ajax-extend plugin, particularly those running older versions (≤1.0), are at significant risk. Shared hosting environments are especially vulnerable, as a compromised plugin on one site could potentially impact other sites on the same server. Sites with weak security configurations or outdated WordPress installations are also at higher risk.

• wordpress / composer / npm:

wp plugin list | grep ajax-extend

• wordpress / composer / npm:

wp plugin update ajax-extend --version=1.0.1

• wordpress / composer / npm:

grep -r 'eval(' /var/www/html/wp-content/plugins/ajax-extend/*

• generic web: Check WordPress plugin directory for mentions of the vulnerability and potential exploit attempts.

1. 2024-10-16Disclosure

   disclosure

1. Réservé2024-10-14
2. Publiée2024-10-16
3. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2024-49254 is to immediately upgrade the ajax-extend plugin to version 1.0.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin. Web application firewalls (WAFs) configured with rules to detect and block code injection attempts may provide some protection. Monitor WordPress logs for suspicious activity, particularly requests containing unusual characters or patterns that might indicate an exploitation attempt. After upgrading, verify the fix by attempting to trigger the vulnerability through a known attack vector (if available) and confirming that the code injection is prevented.