CVE-2024-10793
📋 TL;DR
The WP Activity Log plugin for WordPress has a stored XSS vulnerability that allows unauthenticated attackers to inject malicious scripts via the user_id parameter. These scripts execute when administrative users view affected pages, potentially compromising admin sessions. All WordPress sites using this plugin up to version 5.2.1 are affected.
💻 Affected Systems
- WP Activity Log (WordPress plugin)
📦 What is this software?
Wp Activity Log by Melapress
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, install backdoors, deface websites, or redirect users to malicious sites, leading to complete site compromise.
Likely Case
Attackers inject malicious scripts to steal admin session cookies or credentials, then use those to gain administrative access to the WordPress site.
If Mitigated
With proper web application firewalls and input validation, the risk is reduced to attempted attacks that are blocked before reaching the vulnerable code.
🎯 Exploit Status
The vulnerability is well-documented with public references, and stored XSS vulnerabilities are commonly weaponized in automated attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.2 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3203365/wp-security-audit-log/trunk/classes/WPSensors/class-wp-system-sensor.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WP Activity Log plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 5.2.2+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the vulnerable plugin until patched
wp plugin deactivate wp-security-audit-log
Web Application Firewall Rule
allBlock malicious user_id parameter values
Add WAF rule to block suspicious patterns in user_id parameter
🧯 If You Can't Patch
- Disable the WP Activity Log plugin immediately
- Implement strict Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for WP Activity Log version 5.2.1 or earlierCheck Version:
wp plugin get wp-security-audit-log --field=versionVerify Fix Applied:
Verify plugin version is 5.2.2 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual user_id parameter values in WordPress logs
- Multiple failed XSS attempts in web server logs
Network Indicators:
- HTTP requests with suspicious user_id parameter values containing script tags
SIEM Query:
source="wordpress.log" AND "user_id" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=")