What is the CVSS score of CVE-2024-49254?

CVE-2024-49254 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of ajax-extend are affected by CVE-2024-49254?

The ajax-extend WordPress plugin (versions through 1.0) exposes a critical unauthenticated remote code execution flaw allowing complete server compromise without authentication requirements.

How to fix or mitigate CVE-2024-49254?

Within 24 hours: Identify all WordPress installations running ajax-extend plugin version 1.0 or earlier; review server logs from 30 days prior for signs of compromise; document affected systems. Within 7 days: Deactivate and remove ajax-extend plugin from all affected instances; if functionality is critical, identify and deploy alternative plugins; implement firewall rules to block exploitation attempts. Within 30 days: Monitor vendor advisory channels and plugin repository for patch release; establish automated patch deployment procedures to apply fixes within 48 hours of vendor release.

ajax-extend CVE-2024-49254

CRITICAL

Code Injection (CWE-94)

2024-10-16 audit@patchstack.com

WordPress RCE Code Injection Wordpress Plugin

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:22 NVD

10.0 (CRITICAL)

CVE Published

Oct 16, 2024 - 14:15 nvd

N/A

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in sunjianle ajax-extend ajax-extend allows Code Injection.This issue affects ajax-extend: from n/a through <= 1.0.

AnalysisAI

Unauthenticated remote code execution in the sunjianle ajax-extend WordPress plugin (versions up to and including 1.0) allows attackers to inject and execute arbitrary code on the underlying server with a changed security scope. CVSS 10.0 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact, though no public exploit identified at time of analysis and EPSS sits at a modest 0.70%.

Technical ContextAI

ajax-extend is a WordPress plugin authored by sunjianke that extends AJAX functionality within WordPress sites. The flaw is classified as CWE-94 (Improper Control of Generation of Code, i.e. Code Injection), meaning attacker-controlled input is incorporated into a code execution context - typically PHP eval(), dynamic include/require, or callable dispatch - without adequate validation or sandboxing. In WordPress plugins this class of bug commonly arises from registering AJAX endpoints (wp_ajax_nopriv_* hooks) that pass request parameters into code-evaluation primitives, enabling arbitrary PHP execution within the web server process.

Affected ProductsAI

The vulnerability affects the sunjianle ajax-extend WordPress plugin in all versions from initial release through and including version 1.0, as reported by Patchstack (audit@patchstack.com). No CPE strings were provided in the source data. There is no indication of a fixed branch, and the plugin appears to have no version newer than 1.0 available.

RemediationAI

No vendor-released patch identified at time of analysis - the affected range extends through the latest known release (<= 1.0). The recommended action is to deactivate and remove the ajax-extend plugin from all WordPress installations immediately, as no upgrade path is published; if the plugin is functionally required, replace it with a maintained AJAX-extension plugin. As compensating controls until removal, restrict access to /wp-admin/admin-ajax.php via WAF rules blocking ajax-extend's specific action parameters (side effect: may break legitimate plugin functionality), place the site behind a virtual patching service such as Patchstack or Wordfence which typically ships rules for Patchstack-reported CVEs, and monitor web server logs for anomalous POST requests to admin-ajax.php containing PHP code fragments or base64-encoded payloads. Consult the Patchstack advisory referenced via the audit@patchstack.com CNA assignment for any subsequent vendor response.