CVE-2024-12679
📋 TL;DR
The Prisna GWT WordPress plugin before version 1.4.14 contains a stored cross-site scripting (XSS) vulnerability in its settings. This allows authenticated administrators to inject malicious scripts that execute when other users view affected pages, even in WordPress multisite installations where unfiltered_html is restricted. Only WordPress sites using vulnerable versions of this specific plugin are affected.
💻 Affected Systems
- Prisna GWT WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with admin privileges could inject malicious JavaScript that steals session cookies, redirects users to phishing sites, or performs actions on behalf of authenticated users, potentially leading to complete site compromise.
Likely Case
Malicious admin injects JavaScript payload that executes when other privileged users view plugin settings, potentially allowing privilege escalation or data theft within the WordPress environment.
If Mitigated
With proper user access controls and regular admin auditing, impact is limited to potential data leakage from users who view the malicious settings page.
🎯 Exploit Status
Exploitation requires admin privileges. Attack is straightforward once authenticated as admin.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.14
Vendor Advisory: https://wpscan.com/vulnerability/7ca1438f-4269-4e34-be4a-766276a9f016/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Prisna GWT plugin. 4. Click 'Update Now' if update available. 5. If no update appears, manually download version 1.4.14+ from WordPress.org and replace plugin files.
🔧 Temporary Workarounds
Remove vulnerable plugin
allTemporarily deactivate and remove the Prisna GWT plugin until patched version can be installed
Restrict admin access
allImplement strict access controls and monitoring for admin accounts
🧯 If You Can't Patch
- Remove the Prisna GWT plugin entirely if functionality is not critical
- Implement strict admin account monitoring and limit number of admin users
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Prisna GWT version. If version is below 1.4.14, system is vulnerable.Check Version:
wp plugin list --name=prisna-gwt --field=versionVerify Fix Applied:
After update, verify Prisna GWT plugin shows version 1.4.14 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual admin activity modifying plugin settings
- Multiple failed login attempts followed by successful admin login
Network Indicators:
- Unexpected JavaScript payloads in HTTP POST requests to wp-admin/admin-ajax.php or similar endpoints
SIEM Query:
source="wordpress" AND (event_type="plugin_modified" OR event_type="settings_updated") AND plugin_name="prisna-gwt"