CVE-2024-4144

Executive Summary

CVE-2024-4144 is a critical vulnerability in the Simple Basic Contact Form WordPress plugin, affecting all versions up to and including 20240502. The flaw allows unauthenticated attackers to execute arbitrary WordPress shortcodes. Since shortcodes in WordPress can invoke complex functions (e.g., do_shortcode), the actual impact depends entirely on which other plugins are installed. In a typical WordPress ecosystem, this can lead to data exfiltration, privilege escalation, or remote code execution if a plugin with dangerous shortcodes (e.g., [file_upload], [exec]) is present.

This vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx directly. The plugin fails to sanitize user-supplied input before passing it to do_shortcode(), enabling attackers to inject arbitrary shortcode strings.

Supply Chain & Package Security

This is a WordPress plugin, not an NPM/PyPI/Go/Ruby package. However, the supply chain risk is significant: the plugin is distributed via the official WordPress plugin repository, and no patch has been released. Users must manually remove or disable the plugin until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The base score is moderate, but the actual risk can escalate to High or Critical depending on the presence of other vulnerable plugins that expose dangerous shortcodes.

Deep Dive & Mechanics

The vulnerability resides in the simple-basic-contact-form plugin's handling of form submissions. The plugin likely uses do_shortcode() on user-supplied content without proper validation or sanitization. In WordPress, do_shortcode() processes text for registered shortcodes, which can include built-in shortcodes like [embed], [gallery], or custom shortcodes from other plugins.

Attack Flow:

1. An attacker sends a POST request to the contact form endpoint.
2. The plugin extracts a parameter (e.g., message or subject) and passes it to do_shortcode().
3. The attacker includes a malicious shortcode string, e.g., [contact-form-7 id="123" title="Contact form 1"] or [wpfilebase_upload].
4. WordPress executes the shortcode, potentially uploading files, sending emails, or executing arbitrary code if a plugin like wp-exec-php is installed.

Root Cause: Lack of input sanitization and failure to use wp_kses() or strip_shortcodes() before processing user input.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// In simple-basic-contact-form.php
$message = $_POST['message'];
echo do_shortcode($message);

Patched Code (hypothetical):

$message = sanitize_text_field($_POST['message']);
echo esc_html($message);
// OR
$message = strip_shortcodes(wp_kses_post($_POST['message']));
echo $message;

Explanation: The vulnerable code directly passes user input to do_shortcode(). The patched version sanitizes the input and prevents shortcode execution by using strip_shortcodes() or escaping output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Simple Basic Contact Form plugin (version <= 20240502).
• Another plugin installed that provides a dangerous shortcode (e.g., [file_upload] from a file manager plugin).

Exploit Steps:

1. Identify the contact form endpoint (e.g., /wp-admin/admin-ajax.php?action=simple_basic_contact_form).
2. Craft a POST request with a malicious shortcode in the message parameter.
3. Example using curl:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d "action=simple_basic_contact_form&message=[file_upload]"

4. If a file upload shortcode is available, the attacker can upload a webshell.

Note: No public exploit code is available in Exploit-DB or GitHub at this time.

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to admin-ajax.php with action=simple_basic_contact_form and suspicious message parameters containing square brackets.
• Look for shortcode patterns like [, ], [/ in form submissions.

Hardening:

• Disable or remove the plugin immediately.
• Use a Web Application Firewall (WAF) rule to block requests containing do_shortcode or shortcode syntax in form fields.
• Implement input validation using wp_kses() or strip_shortcodes() in custom code.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=simple_basic_contact_form and message containing [ or ].
  • Unusual shortcode strings in HTTP request bodies (e.g., [file_upload], [exec], [php]).

• File IOCs:

  • Unexpected files in /wp-content/uploads/ (e.g., .php files uploaded via shortcode).
  • Modified .htaccess files or new user accounts.

• Log IOCs:

  • WordPress debug log entries showing do_shortcode calls with unexpected parameters.
  • Apache/Nginx access logs with admin-ajax.php POST requests from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2024_4144_Shortcode_Injection {
    meta:
        description = "Detects shortcode injection attempts targeting Simple Basic Contact Form"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4144"
    strings:
        $shortcode_pattern = /\[[a-zA-Z_]+[^\]]*\]/
        $action_string = "simple_basic_contact_form"
    condition:
        $action_string and #shortcode_pattern > 0
}

Sigma Rule

title: CVE-2024-4144 Shortcode Injection via Simple Basic Contact Form
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to admin-ajax.php with shortcode syntax in the message parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=simple_basic_contact_form'
        cs-request-body|re: '\[[a-zA-Z_]+[^\]]*\]'
    condition: selection
falsepositives:
    - Legitimate use of shortcodes in contact form messages (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-4144 Shortcode Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=simple_basic_contact_form"; http_client_body; pcre:"/\[[a-zA-Z_]+[^\]]*\]/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Simple Basic Contact Form plugin from all WordPress installations.
2. Scan for compromise – Check for unauthorized file uploads, new admin users, and suspicious entries in access logs.
3. Apply virtual patching – Use a WAF to block requests containing shortcode syntax in form fields.

Long-Term Fix:

• The vendor must release a patched version that sanitizes input using wp_kses() or strip_shortcodes() before passing to do_shortcode().
• Until a patch is available, switch to an alternative contact form plugin (e.g., Contact Form 7, WPForms).

Workaround:

• Add the following code to the theme's functions.php to strip shortcodes from all POST data:

add_filter('pre_do_shortcode_tag', function($output, $tag, $attr, $m) {
    if (isset($_POST['message'])) {
        return '';
    }
    return $output;
}, 10, 4);

Valters IT