CVE-2021-24546
📋 TL;DR
This vulnerability allows users with contributor-level access in WordPress to execute arbitrary PHP code through the Gutenberg Block Editor Toolkit plugin. Attackers can inject malicious code via the Conditional Logic field in Custom Visibility settings, leading to remote code execution. WordPress sites using vulnerable versions of the EditorsKit plugin are affected.
💻 Affected Systems
- WordPress Gutenberg Block Editor Toolkit (EditorsKit) plugin
📦 What is this software?
Editorskit by Extendify
⚠️ Risk & Real-World Impact
Worst Case
Full site compromise allowing attackers to execute arbitrary PHP code, install backdoors, steal data, deface websites, or pivot to other systems.
Likely Case
Contributor-level users or attackers who gain contributor access can execute PHP code to modify content, create admin accounts, or install malware.
If Mitigated
With proper role-based access controls and input validation, impact is limited to authorized users only, but still represents significant risk.
🎯 Exploit Status
Exploitation requires contributor-level access. Public proof-of-concept exists showing code injection via Conditional Logic field.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.31.6
Vendor Advisory: https://wpscan.com/vulnerability/bdc36f6a-682d-4d66-b587-92e86085d971
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Gutenberg Block Editor Toolkit – EditorsKit'. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.31.6+ from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Disable EditorsKit Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate editorskit
Restrict Contributor Access
allTemporarily elevate contributor role requirements or restrict access
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block PHP code injection attempts
- Restrict contributor user creation and monitor existing contributor accounts for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → EditorsKit version. If version is below 1.31.6, system is vulnerable.Check Version:
wp plugin get editorskit --field=versionVerify Fix Applied:
Confirm plugin version is 1.31.6 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to wp-admin/admin-ajax.php with conditional_logic parameters
- PHP execution errors in web server logs
- Unauthorized plugin or theme modifications
Network Indicators:
- HTTP requests containing PHP code in conditional logic parameters
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND ("conditional_logic" OR "editorskit") AND ("php:" OR "eval(" OR "system(")