CVE-2024-10958

Executive Summary

CVE-2024-10958 is a critical vulnerability in the WordPress plugin WP Photo Album Plus, affecting all versions up to and including 8.8.08.007. The flaw resides in the getshortcodedrenderedfenodelay AJAX action, which fails to properly validate user-supplied input before passing it to the WordPress do_shortcode() function. This allows an unauthenticated attacker to execute arbitrary WordPress shortcodes, potentially leading to data exfiltration, privilege escalation, or site defacement. The vulnerability is classified as a CWE-94: Improper Control of Generation of Code ('Code Injection') and carries a CVSS score of 7.3 (High). No public proof-of-concept or patch is currently available, making this a high-priority zero-day for WordPress site administrators.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated exploitation.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited modification possible.
• Availability (A): Low (L) – Limited disruption possible.

Threat Level: High. The combination of unauthenticated access, low complexity, and the ability to execute arbitrary shortcodes makes this a serious threat. Shortcodes can be used to read database contents, execute SQL queries, or trigger other plugin functionalities.

Deep Dive & Mechanics

The vulnerability exists in the getshortcodedrenderedfenodelay AJAX action handler within the WP Photo Album Plus plugin. This action is intended to render shortcodes with a delay, but it fails to sanitize or validate the shortcode parameter before passing it to the WordPress do_shortcode() function.

Root Cause: The plugin registers an AJAX action for both authenticated and unauthenticated users (via wp_ajax_ and wp_ajax_nopriv_ hooks). The handler retrieves the shortcode parameter from the request and directly calls do_shortcode($_POST['shortcode']) without any validation or capability check.

Attack Vector: An attacker sends a POST request to /wp-admin/admin-ajax.php with the action parameter set to getshortcodedrenderedfenodelay and a malicious shortcode parameter. For example, the attacker could use [wp_photo_album_plus_get_album id="1"] or any other shortcode registered by WordPress or other plugins.

Impact: Arbitrary shortcode execution can lead to:

• Reading sensitive data (e.g., user lists, post content).
• Executing SQL queries via plugins that expose database shortcodes.
• Triggering file inclusion or deletion if other vulnerable shortcodes exist.
• Escalating privileges if a shortcode creates admin users.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

add_action('wp_ajax_getshortcodedrenderedfenodelay', 'handle_shortcode_delay');
add_action('wp_ajax_nopriv_getshortcodedrenderedfenodelay', 'handle_shortcode_delay');

function handle_shortcode_delay() {
    $shortcode = $_POST['shortcode'];
    echo do_shortcode($shortcode);
    wp_die();
}

Patched Code (hypothetical):

add_action('wp_ajax_getshortcodedrenderedfenodelay', 'handle_shortcode_delay');
add_action('wp_ajax_nopriv_getshortcodedrenderedfenodelay', 'handle_shortcode_delay');

function handle_shortcode_delay() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $shortcode = sanitize_text_field($_POST['shortcode']);
    $allowed_shortcodes = array('wp_photo_album_plus_get_album');
    if (in_array($shortcode, $allowed_shortcodes)) {
        echo do_shortcode($shortcode);
    } else {
        echo 'Shortcode not allowed.';
    }
    wp_die();
}

The patched version adds a capability check (current_user_can('edit_posts')) and validates the shortcode against a whitelist.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with WP Photo Album Plus <= 8.8.08.007 installed.
• No authentication required.

Exploitation Steps:

1. Identify the target WordPress site.
2. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action: getshortcodedrenderedfenodelay
   • shortcode: [wp_photo_album_plus_get_album id="1"] (or any other shortcode)
3. Observe the response containing the rendered shortcode output.

Example cURL command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=getshortcodedrenderedfenodelay&shortcode=[wp_photo_album_plus_get_album id=1]"

Advanced Exploitation:

• Use shortcodes from other plugins to read database contents (e.g., [user_list]).
• Chain with other vulnerabilities to achieve RCE.

Blue Team

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=getshortcodedrenderedfenodelay.
• Look for unusual shortcode parameters in HTTP logs.
• Use the Sigma rule provided in Detection Engineering.

Hunting:

• Search for getshortcodedrenderedfenodelay in web server access logs.
• Check for unexpected shortcode execution in WordPress debug logs.

Lab Setup:

• Install WordPress and WP Photo Album Plus 8.8.08.007 in a sandboxed environment.
• Use a tool like Burp Suite to craft and send malicious requests.
• Monitor logs and system behavior.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=getshortcodedrenderedfenodelay.
  • Unusual shortcode strings in HTTP POST data (e.g., [wp_photo_album_plus_get_album id=1]).
• File:
  • Modified WordPress database entries (e.g., new admin users).
  • Unexpected files in uploads directory.
• Log:
  • WordPress debug log entries showing do_shortcode calls with unexpected parameters.
  • Web server access logs with admin-ajax.php and action=getshortcodedrenderedfenodelay.

Detection Engineering

YARA Rule

rule CVE_2024_10958_Shortcode_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2024-10958 in WP Photo Album Plus"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10958"
    strings:
        $ajax_action = "getshortcodedrenderedfenodelay"
        $shortcode_param = "shortcode="
        $wp_shortcode = /\[wp_photo_album_plus_[a-z_]+\s+[^\]]*\]/
    condition:
        $ajax_action and $shortcode_param and $wp_shortcode
}

Sigma Rule

title: CVE-2024-10958 WP Photo Album Plus Shortcode Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-10958 via AJAX request
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=getshortcodedrenderedfenodelay'
    condition: selection
falsepositives:
    - Legitimate use of the plugin's delayed shortcode feature (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-10958 WP Photo Album Plus Shortcode Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"admin-ajax.php";
    http_uri;
    content:"action=getshortcodedrenderedfenodelay";
    http_client_body;
    content:"shortcode=";
    http_client_body;
    pcre:"/\[wp_photo_album_plus_[a-z_]+\s+[^\]]*\]/Ri";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Add a web application firewall (WAF) rule to block requests containing action=getshortcodedrenderedfenodelay.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the official patch from the vendor when released.
• Update to a patched version (currently unknown).
• Implement input validation and capability checks in custom code.

Workaround:

• Use a WordPress security plugin to restrict AJAX actions to authenticated users only.
• Add the following code to the theme's functions.php to block unauthenticated access:

add_action('wp_ajax_nopriv_getshortcodedrenderedfenodelay', function() {
    wp_die('Unauthorized', 403);
}, 1);

Valters IT
Securing WordPress Ecosystems