CVE-2024-12333

Executive Summary

CVE-2024-12333 is a critical security vulnerability in the Woodmart theme for WordPress, affecting all versions up to and including 8.0.3. The flaw resides in the woodmart_instagram_ajax_query AJAX action, which fails to properly validate user-supplied input before passing it to the do_shortcode() function. This allows an unauthenticated attacker to execute arbitrary WordPress shortcodes, leading to potential data disclosure, privilege escalation, or site defacement. The vulnerability is classified as a CWE-94: Improper Control of Generation of Code ('Code Injection') and has a CVSS score of 6.5 (Medium). As a WordPress ecosystem issue, the attack surface is broad, affecting any site using the vulnerable theme. No public exploit code or patch is currently available, but the risk is elevated due to the unauthenticated nature of the attack.

Supply Chain & Package Security

This vulnerability is specific to the WordPress theme ecosystem, not a package manager (NPM, PyPI, Go, Ruby). However, it highlights supply chain risks in third-party themes. Site owners must verify the integrity of theme updates and monitor for patches from the vendor (Woodmart). Since the patch status is unknown, users should consider disabling the vulnerable AJAX action or applying a Web Application Firewall (WAF) rule as a temporary measure.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – Unauthenticated exploitation.
• User Interaction (UI): None – No user action needed.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): Low – Limited ability to disrupt service.

Threat Level: Medium. While the CVSS score is moderate, the unauthenticated nature and potential for chaining with other vulnerabilities (e.g., stored XSS via shortcodes) elevate the real-world risk.

Deep Dive & Mechanics

The vulnerability is rooted in the woodmart_instagram_ajax_query AJAX action handler within the Woodmart theme. The function receives a parameter (likely action or a custom field) and passes it directly to do_shortcode() without sanitization or validation. WordPress shortcodes can execute arbitrary PHP functions, read files, or perform database operations, depending on the registered shortcodes.

Attack Flow:

1. An attacker sends a crafted POST request to /wp-admin/admin-ajax.php with action=woodmart_instagram_ajax_query and a malicious payload in the vulnerable parameter.
2. The theme’s handler extracts the parameter and calls do_shortcode( $user_input ).
3. The shortcode is executed, allowing the attacker to run any registered shortcode (e.g., [file], [php], or custom ones).
4. The attacker can then exfiltrate data, inject content, or escalate privileges.

Root Cause: Lack of input validation and capability checks. The AJAX action is registered for both authenticated and unauthenticated users, and the parameter is not filtered.

Vulnerable vs. Patched Code

Vulnerable Code (Woodmart <= 8.0.3):

add_action( 'wp_ajax_woodmart_instagram_ajax_query', 'woodmart_instagram_ajax_query' );
add_action( 'wp_ajax_nopriv_woodmart_instagram_ajax_query', 'woodmart_instagram_ajax_query' );

function woodmart_instagram_ajax_query() {
    $shortcode = $_POST['shortcode']; // No validation
    echo do_shortcode( $shortcode ); // Direct execution
    wp_die();
}

Patched Code (Hypothetical):

add_action( 'wp_ajax_woodmart_instagram_ajax_query', 'woodmart_instagram_ajax_query' );
add_action( 'wp_ajax_nopriv_woodmart_instagram_ajax_query', 'woodmart_instagram_ajax_query' );

function woodmart_instagram_ajax_query() {
    // Validate nonce and capabilities
    if ( ! wp_verify_nonce( $_POST['_wpnonce'], 'woodmart_instagram_nonce' ) ) {
        wp_die( 'Invalid nonce' );
    }
    // Whitelist allowed shortcodes
    $allowed_shortcodes = array( 'instagram', 'gallery' );
    $shortcode = sanitize_text_field( $_POST['shortcode'] );
    if ( in_array( $shortcode, $allowed_shortcodes ) ) {
        echo do_shortcode( '[' . $shortcode . ']' );
    } else {
        echo 'Shortcode not allowed';
    }
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site running Woodmart theme <= 8.0.3.
• No authentication required.

Exploit Steps:

1. Identify the vulnerable endpoint: /wp-admin/admin-ajax.php.
2. Craft a POST request with action=woodmart_instagram_ajax_query and a malicious shortcode payload.

Example Payload (using [file] shortcode to read /etc/passwd):

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=woodmart_instagram_ajax_query&shortcode=[file path='/etc/passwd']"

Example Payload (using [php] shortcode to execute system commands):

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=woodmart_instagram_ajax_query&shortcode=[php]echo shell_exec('id');[/php]"

Note: The exact shortcodes available depend on the WordPress installation and plugins. Common dangerous shortcodes include [file], [php], [exec], and [include].

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=woodmart_instagram_ajax_query.
• Look for unusual shortcode patterns in POST parameters (e.g., [file, [php, [exec).
• Use WAF rules to block requests containing do_shortcode or suspicious shortcode tags.

Hardening:

• Disable the AJAX action via a custom plugin or theme functions:

remove_action( 'wp_ajax_woodmart_instagram_ajax_query', 'woodmart_instagram_ajax_query' );
remove_action( 'wp_ajax_nopriv_woodmart_instagram_ajax_query', 'woodmart_instagram_ajax_query' );

• Implement a Web Application Firewall (WAF) rule to block requests with shortcode parameter containing [ or ].
• Restrict access to admin-ajax.php for unauthenticated users if not needed.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=woodmart_instagram_ajax_query.
  • POST body containing shortcode= followed by square brackets (e.g., [file, [php).
• File IOCs:
  • Unexpected files in /wp-content/uploads/ or /tmp/ created by shortcode execution.
  • Modified .htaccess or wp-config.php files.
• Log IOCs:
  • WordPress debug log entries showing do_shortcode calls with unexpected parameters.
  • Web server access logs with admin-ajax.php and woodmart_instagram_ajax_query in the same request.

Detection Engineering

YARA Rule

rule CVE_2024_12333_Woodmart_Shortcode_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2024-12333 in Woodmart theme"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12333"
    strings:
        $ajax_action = "woodmart_instagram_ajax_query"
        $shortcode_param = "shortcode="
        $dangerous_shortcodes = /\[(file|php|exec|include|shell_exec|system|passthru|eval)/
    condition:
        $ajax_action and $shortcode_param and $dangerous_shortcodes
}

Sigma Rule

title: CVE-2024-12333 Woodmart Shortcode Injection Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests targeting the Woodmart theme AJAX action with suspicious shortcode parameters.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=woodmart_instagram_ajax_query"
        cs-uri-query|contains: "shortcode="
    keywords:
        - "[file"
        - "[php"
        - "[exec"
        - "[include"
    condition: selection and keywords
falsepositives:
    - Legitimate use of shortcodes by administrators (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12333 Woodmart Shortcode Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=woodmart_instagram_ajax_query"; http_client_body; content:"shortcode="; http_client_body; pcre:"/\[(file|php|exec|include|shell_exec|system|passthru|eval)/Ri"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable AJAX action by adding the following code to your theme's functions.php or a custom plugin:

add_action( 'init', function() {
    if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
        remove_action( 'wp_ajax_woodmart_instagram_ajax_query', 'woodmart_instagram_ajax_query' );
        remove_action( 'wp_ajax_nopriv_woodmart_instagram_ajax_query', 'woodmart_instagram_ajax_query' );
    }
});

2. Apply a WAF rule to block requests containing shortcode= with square brackets.
3. Monitor logs for exploitation attempts.

Long-Term Fix:

• Update the Woodmart theme to a patched version once released (check the official Woodmart website or ThemeForest).
• Implement input validation for all AJAX actions, especially those using do_shortcode().
• Use a security plugin like Wordfence or Sucuri to add an extra layer of protection.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.