CVE-2024-13379 – The C9 Admin Dashboard WordPress plugin up to v... (How to Fix)

📋 TL;DR

The C9 Admin Dashboard WordPress plugin up to version 1.3.5 allows authenticated attackers with Author-level access or higher to upload malicious SVG files containing JavaScript. When these SVG files are accessed by users, the embedded scripts execute in their browsers, enabling persistent cross-site scripting attacks.

💻 Affected Systems

Products:

C9 Admin Dashboard WordPress Plugin

Versions: All versions up to and including 1.3.5

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with the vulnerable plugin enabled and at least one user with Author role or higher.

📦 What is this software?

C9 Admin Dashboard by Covertnine

View all CVEs affecting C9 Admin Dashboard →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, hijack user sessions, deface websites, or redirect users to malicious sites through persistent XSS payloads.

🟠

Likely Case

Attackers with author accounts inject malicious scripts that execute when users view uploaded SVG files, potentially stealing cookies or session tokens.

🟢

If Mitigated

With proper user access controls and content security policies, impact is limited to isolated script execution without access to sensitive data.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is technically simple - just upload a malicious SVG file with embedded JavaScript.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.3.6 or later

Vendor Advisory: https://wordpress.org/plugins/c9-admin-dashboard/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find C9 Admin Dashboard
4. Click 'Update Now' if available
5. If no update appears, manually download version 1.3.6+ from WordPress.org
6. Deactivate old version, upload new version, activate

🔧 Temporary Workarounds

Disable SVG Uploads

all

Prevent SVG file uploads through WordPress media library

Add to wp-config.php: define('ALLOW_UNFILTERED_UPLOADS', false);
Add to functions.php: add_filter('upload_mimes', function($mimes) { unset($mimes['svg']); return $mimes; });

Restrict Author Role Access

all

Temporarily remove upload capabilities from Author roles

Use plugin like 'User Role Editor' to remove 'upload_files' capability from Author role

🧯 If You Can't Patch

Deactivate the C9 Admin Dashboard plugin immediately
Implement Content Security Policy headers to restrict script execution from untrusted sources

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → C9 Admin Dashboard → Version. If version is 1.3.5 or lower, you are vulnerable.

Check Version:

wp plugin list --name=c9-admin-dashboard --field=version

Verify Fix Applied:

After updating, verify plugin version shows 1.3.6 or higher in WordPress admin plugins page.

📡 Detection & Monitoring

Log Indicators:

Unusual SVG file uploads by Author-level users
Multiple failed login attempts followed by SVG uploads

Network Indicators:

Requests to SVG files with suspicious parameters or unusual file sizes

SIEM Query:

source="wordpress.log" AND ("uploaded.*svg" OR "c9-admin-dashboard") AND user_role="author"

📊 Metadata

CVE ID: CVE-2024-13379

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.07% exploit probability (20th percentile)

Published: February 21, 2025

Last Updated: February 25, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-13379, you might also want to check these: