CVE-2024-13497
📋 TL;DR
The Tripetto WordPress plugin (versions up to 8.0.9) has a stored XSS vulnerability in attachment uploads due to insufficient input sanitization. Unauthenticated attackers can upload malicious files that execute JavaScript when accessed by users. This affects all WordPress sites using vulnerable Tripetto plugin versions.
💻 Affected Systems
- Tripetto WordPress Plugin
📦 What is this software?
Tripetto by Tripetto
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal admin session cookies, redirect users to malicious sites, deface websites, or perform actions as authenticated users.
Likely Case
Session hijacking, credential theft, or website defacement through malicious script execution in user browsers.
If Mitigated
Limited impact with proper CSP headers and file upload restrictions, but still poses risk to users accessing malicious attachments.
🎯 Exploit Status
Exploitation requires uploading malicious files through Tripetto forms, which unauthenticated users can do by default.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.1.0 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Tripetto plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 8.1.0+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable Tripetto Plugin
WordPressTemporarily disable the Tripetto plugin until patched
wp plugin deactivate tripetto
Restrict File Uploads
WordPressConfigure Tripetto to disable attachment uploads or restrict to trusted users only
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Disable Tripetto forms that accept file uploads from unauthenticated users
🔍 How to Verify
Check if Vulnerable:
Check Tripetto plugin version in WordPress admin panel under Plugins > Installed PluginsCheck Version:
wp plugin get tripetto --field=versionVerify Fix Applied:
Verify Tripetto plugin version is 8.1.0 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to Tripetto endpoints
- Multiple failed upload attempts with suspicious filenames
Network Indicators:
- HTTP requests to Tripetto attachment URLs with suspicious parameters
- File uploads to /wp-content/plugins/tripetto/ paths
SIEM Query:
source="wordpress" AND (uri_path="/wp-content/plugins/tripetto/" OR user_agent CONTAINS "Tripetto") AND (method="POST" OR file_upload="true")🔗 References
- https://plugins.trac.wordpress.org/browser/tripetto/trunk/lib/attachments.php#L46
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3251202%40tripetto%2Ftrunk&old=3231968%40tripetto%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fbbe006c-1afc-4c8b-a9f3-ffb21cdabb54?source=cve
