CVE-2024-13472
📋 TL;DR
The WooCommerce Product Table Lite plugin for WordPress allows unauthenticated attackers to execute arbitrary shortcodes due to improper input validation. This vulnerability also enables reflected cross-site scripting attacks via the same parameter. All WordPress sites using this plugin up to version 3.9.4 are affected.
💻 Affected Systems
- WooCommerce Product Table Lite
📦 What is this software?
Woocommerce Product Table by Wcproducttable
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary PHP code, install backdoors, steal sensitive data, or take complete control of the WordPress site.
Likely Case
Attackers will execute malicious shortcodes to deface websites, redirect users, or steal session cookies through XSS attacks.
If Mitigated
With proper web application firewalls and input validation, exploitation attempts would be blocked before reaching vulnerable code.
🎯 Exploit Status
Exploitation requires no authentication and uses simple HTTP requests with malicious shortcode payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.9.5 or later
Vendor Advisory: https://wordpress.org/plugins/wc-product-table-lite/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'WooCommerce Product Table Lite'. 4. Click 'Update Now' if available, or download latest version from WordPress repository. 5. Activate updated plugin.
🔧 Temporary Workarounds
Disable vulnerable plugin
WordPressTemporarily disable the WooCommerce Product Table Lite plugin until patched.
wp plugin deactivate wc-product-table-lite
Web Application Firewall rule
allBlock requests containing 'sc_attrs' parameter with suspicious content.
🧯 If You Can't Patch
- Implement strict input validation to sanitize all user-supplied data before processing
- Deploy a web application firewall (WAF) with rules to block shortcode injection attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for WooCommerce Product Table Lite version 3.9.4 or earlier.Check Version:
wp plugin get wc-product-table-lite --field=versionVerify Fix Applied:
Verify plugin version is 3.9.5 or later in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing 'sc_attrs' parameter with unusual values
- WordPress debug logs showing do_shortcode() errors
Network Indicators:
- POST/GET requests to WordPress endpoints with sc_attrs parameter containing encoded shortcodes
SIEM Query:
source="wordpress_access.log" AND (sc_attrs OR do_shortcode)🔗 References
- https://plugins.trac.wordpress.org/browser/wc-product-table-lite/trunk/main.php#L1843
- https://plugins.trac.wordpress.org/changeset/3231930/
- https://wordpress.org/plugins/wc-product-table-lite/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4f1a1171-3d7b-46a4-982e-fe318e3017b7?source=cve
