CVE-2024-10374
📋 TL;DR
This vulnerability allows authenticated WordPress users with contributor-level access or higher to inject malicious scripts into website pages via the WP-Members Membership Plugin's shortcode. The injected scripts execute whenever other users visit the compromised pages, enabling session hijacking, credential theft, or website defacement. All WordPress sites using WP-Members plugin versions up to 3.4.9.5 are affected.
💻 Affected Systems
- WP-Members Membership Plugin for WordPress
📦 What is this software?
Wp Members by Butlerblog
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, compromise user accounts, redirect visitors to malicious sites, or install backdoors for persistent access.
Likely Case
Malicious contributors or editors inject tracking scripts, adware, or cryptocurrency miners that affect all site visitors.
If Mitigated
With proper user access controls and content review processes, only trusted users can create/edit pages, limiting exploitation opportunities.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once an attacker has contributor credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.9.6 and later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3172530/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP-Members Membership Plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 3.4.9.6+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Remove Contributor Access
allTemporarily revoke contributor and author roles from untrusted users until patching is complete.
Disable Shortcode
allRemove or disable the wpmem_loginout shortcode from all pages/posts.
🧯 If You Can't Patch
- Implement strict content review workflow requiring editor/administrator approval for all page/post changes
- Install a web application firewall (WAF) with XSS protection rules and enable CSP headers
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for WP-Members version. If version is 3.4.9.5 or lower, you are vulnerable.Check Version:
wp plugin list --name=wp-members --field=version (if WP-CLI installed)Verify Fix Applied:
After updating, verify WP-Members plugin version shows 3.4.9.6 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to post/page editors containing script tags or encoded payloads
- Multiple page edits from contributor accounts in short timeframes
Network Indicators:
- Outbound connections to suspicious domains from your WordPress site
- Unexpected script loads in page responses
SIEM Query:
source="wordpress.log" AND ("wpmem_loginout" OR "shortcode" OR "post_content") AND ("script" OR "javascript:" OR "onload=" OR "onerror=")