CVE-2024-10168
📋 TL;DR
This vulnerability allows authenticated WordPress users with contributor-level access or higher to inject malicious scripts into web pages via the woot_button shortcode. The scripts execute when other users view the compromised pages, enabling session hijacking, defacement, or malware distribution. All WordPress sites using the Active Products Tables for WooCommerce plugin versions up to 1.0.6.4 are affected.
💻 Affected Systems
- Active Products Tables for WooCommerce WordPress plugin
📦 What is this software?
Woot by Pluginus
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, take over the WordPress site, install backdoors, and compromise visitor data through malicious scripts.
Likely Case
Attackers deface pages, redirect users to malicious sites, or steal session cookies from logged-in users.
If Mitigated
With proper user role management and input validation, impact is limited to minor defacement or script injection that's quickly detected.
🎯 Exploit Status
Exploitation requires contributor-level access but is technically simple once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.6.5
Vendor Advisory: https://wordpress.org/plugins/profit-products-tables-for-woocommerce/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find 'Active Products Tables for WooCommerce'. 4. Click 'Update Now' if available, or manually update to version 1.0.6.5+. 5. Verify update completes successfully.
🔧 Temporary Workarounds
Disable vulnerable shortcode
allRemove or disable the woot_button shortcode functionality
Add to theme's functions.php: remove_shortcode('woot_button');
Restrict user roles
allTemporarily remove contributor posting capabilities
Use WordPress role editor plugin or add: remove_cap('contributor', 'publish_posts');
🧯 If You Can't Patch
- Implement strict input validation and output escaping for all shortcode attributes
- Apply web application firewall rules to block XSS payloads in POST/GET requests
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin → Plugins → Active Products Tables for WooCommerce. If version is 1.0.6.4 or lower, you're vulnerable.Check Version:
wp plugin list --name='Active Products Tables for WooCommerce' --field=versionVerify Fix Applied:
Confirm plugin version is 1.0.6.5 or higher and test woot_button shortcode with script payloads that should now be sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to wp-admin with script tags in parameters
- Multiple page edits by contributor users in short timeframe
Network Indicators:
- Outbound connections to suspicious domains from your WordPress site
- Unexpected JavaScript includes in page responses
SIEM Query:
source="wordpress" AND ("woot_button" OR "script" OR "onerror") AND status=200