critical CVSS 9.8

CVE-2024-9193·PHP vulnerability

The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the whmpress_domain_search_ajax_extended_results() function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. Utilizing the /admin/services.php file, this can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

Severity
critical
Software
PHP
Fixed in
6.3
Published
2025-02-28

Affected versions

Until: 6.3

Fixed in: 6.3

How to fix this CVE

Update the WHMpress plugin to version 6.3 or later to patch the Local File Inclusion vulnerability that allows unauthenticated attackers to execute arbitrary PHP code. Review your WordPress plugin directory and verify that all instances of WHMpress are running the patched version. Additionally, audit your WordPress user roles and registration settings to ensure no unauthorized administrative accounts were created during the vulnerability window.

sudo dnf update php

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET request containing 'whmpress_domain_search_ajax_extended_results' parameter combined with file path traversal sequences (../, ..\, or absolute paths) or request to '/admin/services.php' with 'registrations_enabled' or 'default_role' parameters from unauthenticated sessions

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Block or rate-limit requests to wp-admin/admin-ajax.php containing the parameter 'action=whmpress_domain_search_ajax_extended_results' unless originating from authenticated WordPress admin sessions; additionally, restrict POST requests to /admin/services.php to authenticated users only

How to check if you are affected

  1. Check installed WHMpress plugin version: Log into WordPress admin panel → Plugins → locate 'WHMpress - WHMCS WordPress Integration' and note the version number displayed
  2. Verify plugin exposure: Confirm the plugin is active by checking if /wp-content/plugins/whmpress/ exists and contains the vulnerable whmpress_domain_search_ajax_extended_results() function in the main plugin file
  3. Search web server logs for exploitation attempts: grep -r 'whmpress_domain_search_ajax_extended_results\|admin/services.php' /var/log/apache2/access.log /var/log/nginx/access.log to identify potential LFI requests
  4. Confirm patch application: In WordPress admin, verify WHMpress version displays 6.3 or higher, then test that arbitrary file inclusion attempts are blocked by accessing a non-existent path through the search function

FAQ

What is CVE-2024-9193?

CVE-2024-9193 is a Local File Inclusion (LFI) flaw in the WHMpress WordPress plugin that permits unauthenticated attackers to include and execute arbitrary PHP files on a server, potentially leading to remote code execution and account compromise.

Is CVE-2024-9193 being actively exploited?

No, CVE-2024-9193 is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are available, though the vulnerability's critical severity warrants immediate patching.

What versions of the WHMpress plugin are affected by CVE-2024-9193?

All versions of WHMpress up to and including version 6.3-revision-0 are vulnerable; version 6.3 and later contain the security fix.

How do I check if my WordPress site is vulnerable to CVE-2024-9193?

Log into your WordPress admin dashboard, navigate to Plugins, and look for WHMpress. If the version number is below 6.3, your installation is vulnerable and requires immediate updating.

Does Defensia detect CVE-2024-9193?

Yes — Defensia's CVE advisory scanner compares installed WordPress plugin versions against the NVD database. If WHMpress is installed on a monitored server, CVE-2024-9193 will appear in your dashboard with remediation steps.

Related PHP CVEs

CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2024-5932CVSS 10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
CVE-2026-39337CVSS 10ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
CVE-2025-62521CVSS 10ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.
CVE-2025-46348CVSS 10YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-9193. Free for 1 server.

Get started free