The vulnerability exists due to improper validation of uploaded files in the wp-admin/options-general.php?page=licence endpoint. Attackers can upload malicious PHP scripts into the /wp-content/plugins/noveldesign-store-directory/images/ directory without authentication, ultimately leading to Remote Code Execution (RCE).

🚨 Key factors enabling the attack:

• No authentication required.
• Unrestricted file upload.
• The uploaded files are directly executable.

🛠️ Exploit Script Overview

A Python-based exploit script has been developed to automate the exploitation process. This script:

✅ Bypasses authentication using random user agents & cookies.
✅ Uploads a malicious PHP shell directly to the server.
✅ Executes arbitrary commands on the compromised machine.
✅ Automatically detects if the target is vulnerable.

📌 Exploit Usage:

🔍 If successful, the shell will be uploaded to:

🚀 Exploitation Steps

1️⃣ Clone the repository:

2️⃣ Run the exploit script:

3️⃣ Access the uploaded shell:

To ensure the exploit script runs smoothly, install the required dependencies using the following command:

🛡️ Mitigation & Fixes

🔹 Update to the latest version of The Novel Design Store Directory plugin.
🔹 Restrict file upload permissions to allow only safe file types.

📝 Disclaimer

⚠️ This exploit is for educational and research purposes only. Unauthorized use of this exploit against systems without proper authorization is illegal. The author is not responsible for any misuse of this information.

🔗 References

• NVD CVE-2024-51788
• Patchstack Advisory

📌 By: Nxploit | Khaled Alenazi | 🔥 Follow for more security research and exploits!