CVE-2024-10872
📋 TL;DR
The Getwid WordPress plugin has a stored XSS vulnerability that allows authenticated attackers with Contributor access or higher to inject malicious scripts into website pages. These scripts execute whenever users view the compromised pages, potentially affecting all visitors to vulnerable WordPress sites.
💻 Affected Systems
- Getwid – Gutenberg Blocks WordPress plugin
📦 What is this software?
Getwid by Motopress
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, deface websites, or perform actions on behalf of authenticated users.
Likely Case
Attackers with contributor accounts inject malicious scripts to steal admin credentials or redirect users to phishing sites.
If Mitigated
With proper user access controls and content filtering, impact is limited to isolated page defacement.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once attacker has Contributor privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.13
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3188812
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Getwid plugin and click 'Update Now'. 4. Verify version is 2.0.13 or higher.
🔧 Temporary Workarounds
Disable Getwid plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate getwid
Restrict user roles
linuxRemove Contributor role from untrusted users
wp user list --role=contributor --field=ID | xargs wp user set-role subscriber
🧯 If You Can't Patch
- Implement web application firewall with XSS protection rules
- Enable Content Security Policy headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Getwid version. If version ≤ 2.0.12, vulnerable.Check Version:
wp plugin get getwid --field=versionVerify Fix Applied:
Verify Getwid plugin version is 2.0.13 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Unusual post/page edits by Contributor users
- Script tags in post content containing 'template-post-custom-field'
Network Indicators:
- Unexpected script loads from WordPress pages
- Suspicious outbound connections from site visitors
SIEM Query:
source="wordpress.log" AND ("template-post-custom-field" OR "getwid") AND ("script" OR "onclick" OR "javascript:")