What is a Remote Code Execution vulnerability?

The legendary Remote Code Execution is an uncommon but critical security vulnerability that allows an attacker to run arbitrary code or command line commands on a server or application remotely. In the context of WordPress, RCE vulnerabilities occur when attackers exploit flaws in the core system, themes, or most commonly, plugins, to execute malicious PHP code on a WordPress site.

What Causes a Remote Code Execution (RCE) Vulnerability?

RCE happens when a user-supplied value is executed in a PHP function that opens a shell command. Common functions used include shell_exec, exec, popen, system, passthru, and proc_open.

Additionally, RCE can happen when arbitrary PHP code can be executed directly.

The behavior of RCE can vary depending on the hosting environment where the WordPress website is hosted. Poor configurations at the hosting level can make it easier for this vulnerability to be exploited.

Most often, RCE is caused by insufficient input validation and sanitization. It can also result from improper use of the eval() function or when file uploads are not properly validated.

What Can Happen If Your WordPress Website Has a RCE Vulnerability?

Remote Code Execution is often considered the “holy grail” of security vulnerabilities. Its severity is typically extreme, allowing attackers to completely hijack a website without much effort.

One notable example of a widely exploited, high-severity RCE vulnerability occurred earlier this year and affected the Bricks Builder. This flaw allowed any unauthenticated user to execute malicious PHP code on the site directly without authorization. Many websites were quickly compromised and infected with malware. Full technical details about this vulnerability can be found here.

How Can WordPress Developers Prevent RCE Vulnerabilities?

Plugin developers should pay close attention to how user input is validated. When passing arguments to a binary, consider using escapeshellarg to safely escape input as well as validating that the user input is of the proper format. It’s also best to avoid dangerous PHP functions altogether, such as eval(). Also use the WordPress built-in file validation functions to avoid an arbitrary file upload vulnerability which can end up in a RCE vulnerability. Additionally, always use access control and nonces to avoid sensitive actions from being executed as an unauthorized user.

For those building WordPress websites, stay alert to security patches released for plugins and themes. If a Remote Code Execution vulnerability is identified, take immediate action. This type of vulnerability should always be treated as a top priority.