CVE-2024-12444
📋 TL;DR
The WP Dispensary WordPress plugin has a stored XSS vulnerability in its 'wpd_menu' shortcode that allows authenticated attackers with contributor-level access or higher to inject malicious scripts. These scripts execute whenever users view pages containing the compromised shortcode, potentially compromising visitor sessions and site integrity.
💻 Affected Systems
- WP Dispensary WordPress Plugin
📦 What is this software?
Wp Dispensary by Wpdispensary
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.
Likely Case
Attackers with contributor access inject malicious scripts to steal user session cookies or display unwanted content to visitors.
If Mitigated
With proper user access controls and content filtering, impact is limited to potential data leakage from affected user sessions.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once attacker has contributor-level credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.1 or later
Vendor Advisory: https://wordpress.org/plugins/wp-dispensary
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP Dispensary and click 'Update Now'. 4. Verify plugin version is 4.5.1 or higher.
🔧 Temporary Workarounds
Remove Contributor Access
allTemporarily revoke contributor-level access from untrusted users until patch is applied.
Disable Plugin
linuxDeactivate WP Dispensary plugin if not essential for site functionality.
wp plugin deactivate wp-dispensary
🧯 If You Can't Patch
- Implement strict user access controls and audit all users with contributor-level permissions
- Deploy web application firewall with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for WP Dispensary version 4.5.0 or lower.Check Version:
wp plugin list --name=wp-dispensary --field=versionVerify Fix Applied:
Confirm WP Dispensary plugin version is 4.5.1 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual shortcode modifications in post/page content
- Multiple failed login attempts followed by contributor account access
Network Indicators:
- Suspicious JavaScript payloads in HTTP POST requests to WordPress admin endpoints
SIEM Query:
source="wordpress.log" AND ("wpd_menu" OR "wp-dispensary") AND ("script" OR "javascript" OR "onclick")