The Customizer Export/Import plugin for WordPress suffers from an unrestricted file upload vulnerability identified as CVE-2024-7620, classified under CWE-434. This vulnerability arises from the absence of proper file type validation in the '_import' function across all plugin versions up to 0.9.7. Authenticated users with Administrator-level privileges or higher can exploit this flaw to upload arbitrary files to the server hosting the WordPress site. The uploaded files could potentially be malicious, enabling remote code execution (RCE) if the attacker successfully executes a race condition to prevent the automatic deletion of the uploaded file, which normally occurs shortly after upload. The attack vector requires network access (remote), high attack complexity due to the race condition, and high privileges, with no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability by allowing attackers to execute arbitrary code, potentially leading to full site compromise. Despite the medium CVSS score of 6.6, the exploitation complexity and privilege requirements reduce the likelihood of widespread exploitation. No patches or exploits are currently publicly available, but the risk remains significant for sites running vulnerable versions of the plugin.

If exploited, this vulnerability can lead to severe consequences including unauthorized remote code execution, full site compromise, data theft, defacement, or use of the server as a launchpad for further attacks. Organizations relying on the Customizer Export/Import plugin risk losing control over their WordPress environment, which can affect website availability and integrity. The requirement for administrator-level access limits the threat to insiders or attackers who have already compromised an admin account, but the potential damage remains high. The race condition adds complexity but does not eliminate the risk, especially in high-traffic environments where timing attacks are more feasible. This vulnerability could also facilitate lateral movement within an organization’s network if the compromised WordPress server is connected to internal resources.

1. Immediately update the Customizer Export/Import plugin to a version that addresses this vulnerability once available. 2. Until a patch is released, restrict administrator access to trusted users only and monitor admin accounts for suspicious activity. 3. Implement Web Application Firewall (WAF) rules to detect and block suspicious file upload attempts targeting the plugin’s import functionality. 4. Employ file integrity monitoring to detect unauthorized file uploads or modifications in the WordPress installation directories. 5. Harden WordPress file permissions to limit the ability of uploaded files to execute code. 6. Monitor server logs for unusual race condition exploitation patterns or repeated upload attempts. 7. Consider disabling or removing the plugin if it is not essential to reduce the attack surface. 8. Use multi-factor authentication (MFA) for all administrator accounts to reduce the risk of credential compromise.