CVE-2024-12493

Executive Summary

CVE-2024-12493 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Files Download Delay WordPress plugin, versions up to and including 1.0.9. The flaw resides in the fddwrap shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and no public exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains for WordPress sites using this plugin.

WordPress Ecosystem Context

This vulnerability is specific to the Files Download Delay plugin for WordPress. It is not related to Apache, Nginx, or any other web server software. The attack vector relies on the WordPress shortcode API and the plugin’s failure to sanitize user input.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs Contributor-level access or higher.
• User Interaction: None (UI:N) – The victim does not need to perform any action beyond viewing the page.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited modification of content possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts that execute for all visitors makes this a significant risk for multi-user WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the fddwrap shortcode provided by the Files Download Delay plugin. Shortcodes in WordPress allow users to embed dynamic content via simple tags like [fddwrap attribute="value"]. The plugin fails to properly sanitize and escape the attribute parameters passed to this shortcode.

Attack Flow:

1. An authenticated user with Contributor-level access or higher creates or edits a post/page.
2. The user inserts the [fddwrap] shortcode with a malicious payload in an attribute, e.g., [fddwrap class="<script>alert('XSS')</script>"].
3. The plugin processes the shortcode and outputs the attribute value without proper escaping.
4. When any user (including admins) views the page, the injected script executes in their browser.

Root Cause: Insufficient input sanitization and output escaping on user-supplied attributes. The plugin likely uses echo $attribute instead of esc_attr() or wp_kses().

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below. A patched version would need to properly escape output.

Vulnerable Code (Conceptual):

function fddwrap_shortcode($atts) {
    $class = $atts['class'];
    return '<div class="' . $class . '">Content</div>';
}
add_shortcode('fddwrap', 'fddwrap_shortcode');

Patched Code (Conceptual):

function fddwrap_shortcode($atts) {
    $class = esc_attr($atts['class']);
    return '<div class="' . $class . '">Content</div>';
}
add_shortcode('fddwrap', 'fddwrap_shortcode');

The patched version uses esc_attr() to escape the attribute value, preventing XSS.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Files Download Delay plugin version <= 1.0.9.
• An account with Contributor-level access or higher.

Steps:

1. Log in to WordPress as a Contributor.
2. Create a new post or page.
3. In the editor, switch to Text mode and insert the following shortcode:

   [fddwrap class="&quot;><script>alert(document.cookie)</script>"]
   

4. Publish the post.
5. When any user visits the post, the JavaScript executes.

Note: No public exploit code is available. The above is a proof-of-concept.

Blue Team (Detection & Prevention)

Detection:

• Monitor for posts/pages containing the [fddwrap] shortcode with suspicious attributes.
• Review user activity logs for Contributor-level users creating content with unusual shortcodes.
• Use WAF rules to block common XSS payloads in shortcode attributes.

Prevention:

• Disable or remove the Files Download Delay plugin until a patch is released.
• Restrict Contributor-level permissions to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/files-download-delay/ (plugin directory)
• Shortcode Pattern: [fddwrap class="..."] with suspicious JavaScript or HTML in attributes.
• Log Entry: WordPress post/page creation by Contributor-level users containing the fddwrap shortcode.
• Network Traffic: Outbound requests from injected scripts (e.g., to attacker-controlled domains).

Detection Engineering

YARA Rule

rule CVE_2024_12493_WordPress_Plugin_XSS {
    meta:
        description = "Detects malicious shortcode attributes in Files Download Delay plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12493"
    strings:
        $shortcode = /\[fddwrap\s+[^\]]*?(class|id|style)\s*=\s*["'][^"']*?(<|>|script|on\w+=)/i
    condition:
        $shortcode
}

Sigma Rule

title: CVE-2024-12493 WordPress Files Download Delay XSS
id: 8a3f7c2e-1b4d-4e5f-9a0b-2c3d4e5f6a7b
status: experimental
description: Detects stored XSS via fddwrap shortcode in WordPress
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "fddwrap"
        http.url|re: "class=|id=|style="
        http.url|contains: "<script"
    condition: selection
falsepositives:
    - Legitimate use of shortcode with safe attributes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12493 WordPress Files Download Delay XSS"; flow:to_server,established; content:"fddwrap"; http_uri; pcre:"/(class|id|style)\s*=\s*[\"'][^\"']*?(<|>|script|on\w+=)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and remove the Files Download Delay plugin from all WordPress installations.
2. Audit existing content – Search for posts/pages containing the [fddwrap] shortcode and remove or sanitize them.
3. Review user roles – Restrict Contributor-level access to only trusted users.

Long-term Fix:

• The vendor must release a patched version that properly escapes shortcode attributes using esc_attr() or wp_kses().
• Until a patch is available, consider using an alternative plugin for file download delays.

Workaround:

• Implement a Web Application Firewall (WAF) rule to block requests containing fddwrap with suspicious patterns.
• Add a Content Security Policy (CSP) header to prevent execution of inline scripts.

Valters IT
Securing Digital Frontiers