Remote Code Execution in RD Station Plugin

The RD Station plugin (≤ 5.6.0) contains a critical remote code execution vulnerability that allows low-privilege users to execute arbitrary PHP code on your server. If you’re using this plugin, update immediately.

What’s the issue?

RD Station integrates your WordPress contact forms with the RD Station CRM. The plugin logs API interactions to a file for debugging. The problem: it constructs the log file path using the OAuth refresh token stored in the database, without validating the path.

An attacker with Contributor-level access (or via database compromise) can inject a path traversal sequence into the refresh token option. When the plugin writes logs, it creates a PHP file in a web-accessible directory. The attacker then accesses that file via HTTP and executes arbitrary code.

How does the attack work?

Step 1: Inject a malicious token

The attacker sets the rdsm_refresh_token option to something like:

../../wp-content/plugins/rd-station/shell.php

This can be done by:

• Creating a Contributor account and manipulating the database
• Exploiting another vulnerability to gain database access
• Compromising an existing Contributor account

Step 2: Trigger a log write

The plugin logs API responses whenever forms are submitted or the plugin communicates with RD Station. Any of these actions will trigger the vulnerable code path:

$file_path = trailingslashit(RDSM_LOG_FILE_PATH) . get_option('rdsm_refresh_token');
RDSMLogFileHelper::write_to_log_file($log_string);

Step 3: PHP file is created

The log file is written to /wp-content/plugins/rd-station/shell.php (or wherever the attacker directed it).

Step 4: Code execution

The attacker visits https://example.com/wp-content/plugins/rd-station/shell.php in their browser. The PHP code executes with the privileges of the web server.

What can an attacker do?

Once code execution is achieved, the attacker can:

• Read your database (customer data, passwords, payment info)
• Modify or delete your site
• Install a backdoor for persistent access
• Deploy malware (cryptominers, ransomware)
• Pivot to other sites on your server
• Escalate privileges to root via kernel exploits

This is a full server compromise.

Who’s affected?

• Versions: RD Station Plugin ≤ 5.6.0
• Privilege Required: Contributor or higher (low privilege)
• Status: Actively exploited in automated mass-scanning campaigns
• CVSS Score: 9.9 (Critical)

What should you do?

Immediate

1. Update now. Version 5.7.0 patches this vulnerability. Update immediately via the WordPress plugin dashboard.
2. If you can’t update immediately, deactivate the plugin until you can patch it.
3. Audit user accounts. Review your WordPress users and remove any suspicious Contributor accounts.
4. Check your logs. Look for suspicious form submissions or API calls around the time of any potential compromise.
5. Run a malware scan. Use a tool like Wordfence or Sucuri to scan for backdoors and malware.

Longer-term

• Review your database for suspicious rdsm_refresh_token values containing ../ or ..\\
• Check your file system for unexpected PHP files in the plugin directory
• Consider limiting Contributor access to trusted users only
• Enable two-factor authentication for all admin accounts

The fix

Version 5.7.0 addresses this by:

• Properly escaping the refresh token before using it in file paths
• Validating paths to prevent directory traversal
• Stricter permission checks on AJAX endpoints
• Enhanced input sanitisation throughout

Timeline

• Discovered: 4 June 2026
• Reporter: ParkHyunWoo (Patchstack Bug Bounty)
• Patch Released: 5.7.0
• Public Disclosure: 4 June 2026
• Exploitation: Active in the wild

This is one of those vulnerabilities where the fix is straightforward, but the impact is severe. Update your plugins regularly, limit user permissions, and monitor your logs for suspicious activity.