CVE-2024-11724
📋 TL;DR
This vulnerability allows authenticated WordPress users with Subscriber-level access or higher to whitelist scripts without proper authorization. Attackers can bypass intended restrictions in the Cookie Consent plugin, potentially allowing malicious scripts to execute. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could whitelist malicious JavaScript that steals user credentials, session cookies, or performs other malicious actions on the site.
Likely Case
Attackers bypass script blocking controls to execute tracking scripts, ads, or other unwanted content that should be blocked by the plugin.
If Mitigated
With proper user role management and monitoring, impact is limited to script whitelisting only, not direct code execution.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.6
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Cookie Consent for WP' plugin
4. Click 'Update Now' if update is available
5. Alternatively, download version 3.6.6 from WordPress repository and manually update
🔧 Temporary Workarounds
Disable vulnerable AJAX endpoint
allRemove or restrict access to the wpl_script_save AJAX action
Add to theme's functions.php or custom plugin:
add_action('init', function() {
remove_action('wp_ajax_wpl_script_save', 'wpl_script_save_callback');
remove_action('wp_ajax_nopriv_wpl_script_save', 'wpl_script_save_callback');
});
Restrict user capabilities
allTemporarily restrict Subscriber role capabilities until patch is applied
Use WordPress role management plugin or add to functions.php:
add_action('init', function() {
$subscriber = get_role('subscriber');
if ($subscriber) {
$subscriber->remove_cap('read');
}
});
🧯 If You Can't Patch
- Disable the Cookie Consent plugin entirely until patched
- Implement strict user role management and monitor for suspicious AJAX requests
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for 'Cookie Consent for WP' version 3.6.5 or lowerCheck Version:
wp plugin list --name='Cookie Consent for WP' --field=versionVerify Fix Applied:
Verify plugin version shows 3.6.6 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual AJAX requests to admin-ajax.php with action=wpl_script_save from non-admin users
- Multiple script whitelisting attempts from single user
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=wpl_script_save parameter
SIEM Query:
source="wordpress" AND uri_path="/wp-admin/admin-ajax.php" AND http_method="POST" AND query_string="action=wpl_script_save"