What is the CVSS score of CVE-2024-49254?

CVE-2024-49254 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of ajax-extend are affected by CVE-2024-49254?

The ajax-extend WordPress plugin (versions through 1.0) exposes a critical unauthenticated remote code execution flaw allowing complete server compromise without authentication requirements.

How to fix or mitigate CVE-2024-49254?

Within 24 hours: Identify all WordPress installations running ajax-extend plugin version 1.0 or earlier; review server logs from 30 days prior for signs of compromise; document affected systems. Within 7 days: Deactivate and remove ajax-extend plugin from all affected instances; if functionality is critical, identify and deploy alternative plugins; implement firewall rules to block exploitation attempts. Within 30 days: Monitor vendor advisory channels and plugin repository for patch release; establish automated patch deployment procedures to apply fixes within 48 hours of vendor release.

ajax-extend CVE-2024-49254

CRITICAL

Code Injection (CWE-94)

2024-10-16 audit@patchstack.com

Code Injection RCE

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:22 NVD

10.0 (CRITICAL)

CVE Published

Oct 16, 2024 - 14:15 nvd

N/A

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in sunjianle ajax-extend ajax-extend allows Code Injection.This issue affects ajax-extend: from n/a through <= 1.0.

AnalysisAI

Unauthenticated remote code execution in the sunjianle ajax-extend WordPress plugin (versions up to and including 1.0) allows attackers to inject and execute arbitrary code on the underlying server with a changed security scope. CVSS 10.0 reflects network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact, though no public exploit identified at time of analysis and EPSS sits at a modest 0.70%.

Technical ContextAI

ajax-extend is a WordPress plugin authored by sunjianke that extends AJAX functionality within WordPress sites. The flaw is classified as CWE-94 (Improper Control of Generation of Code, i.e. Code Injection), meaning attacker-controlled input is incorporated into a code execution context - typically PHP eval(), dynamic include/require, or callable dispatch - without adequate validation or sandboxing. In WordPress plugins this class of bug commonly arises from registering AJAX endpoints (wp_ajax_nopriv_* hooks) that pass request parameters into code-evaluation primitives, enabling arbitrary PHP execution within the web server process.

Affected ProductsAI

The vulnerability affects the sunjianle ajax-extend WordPress plugin in all versions from initial release through and including version 1.0, as reported by Patchstack (audit@patchstack.com). No CPE strings were provided in the source data. There is no indication of a fixed branch, and the plugin appears to have no version newer than 1.0 available.

RemediationAI

No vendor-released patch identified at time of analysis - the affected range extends through the latest known release (<= 1.0). The recommended action is to deactivate and remove the ajax-extend plugin from all WordPress installations immediately, as no upgrade path is published; if the plugin is functionally required, replace it with a maintained AJAX-extension plugin. As compensating controls until removal, restrict access to /wp-admin/admin-ajax.php via WAF rules blocking ajax-extend's specific action parameters (side effect: may break legitimate plugin functionality), place the site behind a virtual patching service such as Patchstack or Wordfence which typically ships rules for Patchstack-reported CVEs, and monitor web server logs for anomalous POST requests to admin-ajax.php containing PHP code fragments or base64-encoded payloads. Consult the Patchstack advisory referenced via the audit@patchstack.com CNA assignment for any subsequent vendor response.