CVE-2024-13118
📋 TL;DR
The IP Based Login WordPress plugin before version 2.4.1 lacks CSRF protection on certain endpoints, allowing attackers to trick authenticated administrators into deleting all plugin logs via malicious requests. This affects WordPress sites using vulnerable versions of the IP Based Login plugin.
💻 Affected Systems
- WordPress IP Based Login plugin
📦 What is this software?
Ip Based Login by Brijeshk89
⚠️ Risk & Real-World Impact
Worst Case
An attacker could delete all IP-based login logs, potentially covering tracks of unauthorized access or preventing administrators from investigating security incidents.
Likely Case
Attackers could disrupt audit trails by deleting logs, making forensic investigation more difficult after other attacks.
If Mitigated
With proper CSRF protections in place, only legitimate authenticated users can perform log deletion actions.
🎯 Exploit Status
Exploitation requires social engineering to trick an authenticated administrator into clicking a malicious link or visiting a compromised page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.1
Vendor Advisory: https://wpscan.com/vulnerability/eba6f98e-b931-4f02-b190-ca855a674839/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'IP Based Login' plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 2.4.1+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the IP Based Login plugin until patched
wp plugin deactivate ip-based-login
Implement CSRF protection middleware
allAdd WordPress nonce verification to plugin endpoints via custom code
🧯 If You Can't Patch
- Restrict admin access to trusted networks only
- Implement web application firewall with CSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → IP Based Login → Version number. If version is below 2.4.1, system is vulnerable.Check Version:
wp plugin get ip-based-login --field=versionVerify Fix Applied:
Confirm plugin version is 2.4.1 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unexpected bulk deletion of IP Based Login plugin logs
- CSRF token validation failures in WordPress logs
Network Indicators:
- POST requests to /wp-admin/admin.php?page=ip-based-login without proper referrer headers
SIEM Query:
source="wordpress" AND (uri_path="/wp-admin/admin.php" AND uri_query="page=ip-based-login" AND http_method="POST")