CVE-2024-11276

Executive Summary

CVE-2024-11276 is a reflected Cross-Site Scripting (XSS) vulnerability in the PDF Builder for WooCommerce WordPress plugin, affecting all versions up to and including 1.2.136. The flaw resides in the page parameter, which is insufficiently sanitized and escaped before being reflected back to the user. An unauthenticated attacker can craft a malicious link that, when clicked by a logged-in administrator or shop manager, executes arbitrary JavaScript in the context of the WordPress admin panel. This can lead to session hijacking, privilege escalation, or the injection of backdoor admin users. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the plugin’s widespread use in WooCommerce stores elevates the risk.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is installed directly from the WordPress admin dashboard or via manual upload. The lack of a patch from the vendor (Rednao) means site operators must rely on temporary mitigations or disable the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability to execute arbitrary JavaScript in the WordPress admin context can lead to full site compromise if an administrator is targeted.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the WordPress admin area. The plugin registers an admin page under the wp-admin/admin.php?page=pdf-builder-for-woocommerce slug. The page parameter is used to determine which sub-page to load. However, the plugin directly echoes the page parameter value without proper sanitization or output escaping.

Root Cause: In the plugin’s main admin handler, the page parameter is retrieved via $_GET['page'] and then used in a URL or displayed in the page title without being passed through esc_html() or esc_url(). This allows an attacker to inject arbitrary HTML and JavaScript.

Attack Flow:

1. Attacker crafts a URL: https://victim.com/wp-admin/admin.php?page=<script>alert('XSS')</script>
2. Attacker sends this link to a logged-in administrator via email, social engineering, or other means.
3. Administrator clicks the link while authenticated.
4. The browser executes the injected script in the context of the WordPress admin panel.
5. The script can perform actions such as creating a new admin user, exfiltrating session cookies, or modifying plugin settings.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.2.136):

// In the plugin's main admin file
function pdf_builder_admin_page() {
    $page = $_GET['page'];
    echo '<div class="wrap"><h1>' . $page . '</h1></div>';
}

Patched Code (hypothetical fix):

function pdf_builder_admin_page() {
    $page = isset($_GET['page']) ? sanitize_text_field($_GET['page']) : '';
    echo '<div class="wrap"><h1>' . esc_html($page) . '</h1></div>';
}

The fix uses sanitize_text_field() to strip malicious input and esc_html() to safely encode output. As of this report, no official patch has been released.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress installation with the vulnerable plugin active.
• A logged-in administrator user.

Exploit Steps:

1. Identify the vulnerable parameter: page in wp-admin/admin.php.
2. Craft a payload that performs a privileged action, e.g., creating a new admin user:

   https://victim.com/wp-admin/admin.php?page=<script>fetch('/wp-admin/admin-ajax.php?action=create_admin_user').then(r=>r.text()).then(console.log)</script>
   

   (Note: This requires a custom AJAX handler; a real exploit would use existing WordPress functions.)
3. Use a social engineering campaign to trick an admin into clicking the link.
4. Once clicked, the script executes and can exfiltrate data or perform actions.

Proof-of-Concept (PoC):

<!-- Save as poc.html and host on attacker server -->
<a href="https://victim.com/wp-admin/admin.php?page=<script>alert(document.cookie)</script>">Click me</a>

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /wp-admin/admin.php with suspicious page parameter values containing <script>, onerror=, or other XSS vectors.
• Use a Web Application Firewall (WAF) to block requests with obvious XSS patterns in the page parameter.

Mitigation:

• Disable the plugin until a patch is available.
• Implement a Content Security Policy (CSP) that restricts script execution.
• Use WordPress security plugins like Wordfence to add virtual patching.

Indicators of Compromise (IOCs)

• URL Pattern: wp-admin/admin.php?page=<script>...
• Log Entries: Requests to /wp-admin/admin.php with page parameter containing HTML/JavaScript.
• File Changes: Unexpected admin users created, or plugin files modified.
• Network Traffic: Outbound connections from the WordPress server to attacker-controlled domains (if the payload exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2024_11276_XSS_WordPress {
    meta:
        description = "Detects reflected XSS attempts against PDF Builder for WooCommerce plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11276"
    strings:
        $xss_payload = /page=<[^>]*script/
    condition:
        $xss_payload
}

Sigma Rule

title: Reflected XSS via page parameter in PDF Builder for WooCommerce
id: 8a3f7c2e-1b4d-4e9f-8c6a-5d2e3f1a0b7c
status: experimental
description: Detects reflected XSS attempts against CVE-2024-11276
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'page=<'
    condition: selection
falsepositives:
    - Legitimate use of HTML in page parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11276 Reflected XSS in PDF Builder for WooCommerce"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=<"; http_uri; pcre:"/page=<[^>]*script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to business operations.
2. Apply virtual patching via WAF rules that block page=<script> patterns.
3. Educate administrators about phishing attacks targeting this vulnerability.

Long-Term Fix:

• The vendor (Rednao) must release a patched version that sanitizes the page parameter. Until then, consider replacing the plugin with an alternative.

Workaround:

• Add the following code to the theme's functions.php to sanitize the parameter:

add_action('init', function() {
    if (isset($_GET['page']) && strpos($_GET['page'], 'pdf-builder-for-woocommerce') !== false) {
        $_GET['page'] = sanitize_text_field($_GET['page']);
    }
});

Valters IT
Securing Digital Frontiers