CVE-2024-10233
📋 TL;DR
This vulnerability allows authenticated attackers with contributor-level access or higher to inject malicious scripts into WordPress pages using the SMS Alert plugin's shortcode. When users visit compromised pages, the scripts execute in their browsers, potentially stealing session cookies or redirecting to malicious sites. All WordPress sites using SMS Alert Order Notifications plugin versions up to 3.7.5 are affected.
💻 Affected Systems
- SMS Alert Order Notifications - WooCommerce WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, take over WordPress sites, install backdoors, or redirect users to phishing/malware sites.
Likely Case
Attackers with contributor access inject malicious scripts that steal user session data or display unwanted content on affected pages.
If Mitigated
With proper user access controls and content security policies, impact is limited to defacement or minor data leakage from affected pages.
🎯 Exploit Status
Exploitation requires contributor-level WordPress access; attack vectors include malicious posts/pages using the sa_subscribe shortcode.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.6 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3175629/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'SMS Alert Order Notifications - WooCommerce'. 4. Click 'Update Now' if available, or download latest version from WordPress repository. 5. Activate updated plugin.
🔧 Temporary Workarounds
Remove Contributor Role Access
allTemporarily restrict contributor-level users from creating/modifying posts until patch is applied.
Disable Plugin
allDeactivate SMS Alert plugin if not critically needed until patched.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to block inline script execution
- Review and audit all posts/pages created by contributor-level users for suspicious shortcode usage
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → SMS Alert Order Notifications - WooCommerce → Version number. If version is 3.7.5 or lower, system is vulnerable.Check Version:
wp plugin list --name='sms-alert' --field=version (if WP-CLI installed)Verify Fix Applied:
After update, verify plugin version shows 3.7.6 or higher in WordPress admin plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual post/page modifications by contributor users
- Multiple failed login attempts followed by successful contributor login
Network Indicators:
- Unexpected script tags in page responses containing 'sa_subscribe' attributes
SIEM Query:
source="wordpress.log" AND ("sa_subscribe" OR "contributor" AND "post_modified")