CVE-2024-9193
Published: 28 February 2025
Summary
CVE-2024-9193 is a critical-severity PHP Remote File Inclusion (CWE-98) vulnerability in Whmpress Whmcs. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The WHMpress - WHMCS WordPress Integration Plugin for WordPress is vulnerable to local file inclusion in all versions through 6.3-revision-0. The flaw exists in the whmpress_domain_search_ajax_extended_results() function and permits inclusion and execution of arbitrary server-side files, which can lead to PHP code execution when an attacker can upload or reference files such as images.
Unauthenticated remote attackers can exploit the issue over the network to bypass access controls, read sensitive data, or obtain arbitrary code execution. The same vector also allows modification of arbitrary WordPress options; by updating the default registration role to administrator and enabling open registration via /admin/services.php, an attacker can create an administrative account and fully compromise the site. The vulnerability carries a CVSS 3.1 score of 9.8.
The vendor’s change log and the Wordfence advisory provide the primary sources for patch availability and further technical detail. The EPSS score rose from lower values after disclosure to a peak of 0.3016 on 2026-02-03 before receding to the current 0.1605, indicating increased exploitation interest following public release.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53966
Vulnerability details
The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the whmpress_domain_search_ajax_extended_results() function. This makes it possible for unauthenticated attackers to include and execute arbitrary…
more
files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. Utilizing the /admin/services.php file, this can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress plugin directly enables remote unauthenticated code execution via arbitrary file inclusion (T1190); this facilitates deployment and execution of PHP-based web shells (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2024-9193 by identifying, reporting, and patching the LFI flaw in the WHMpress plugin's whmpress_domain_search_ajax_extended_results() function.
Implements input validation at the vulnerable AJAX endpoint to block arbitrary file paths that enable local file inclusion and PHP code execution.
Scans systems for vulnerabilities like CVE-2024-9193 in WordPress plugins, enabling detection and prioritization for remediation.