CVE-2024-13757
📋 TL;DR
This vulnerability allows authenticated WordPress users with contributor-level access or higher to inject malicious scripts into web pages using the Master Slider plugin's ms_layer shortcode. The scripts execute whenever users visit the compromised pages, enabling attackers to steal session cookies, redirect users, or perform other malicious actions. All WordPress sites using Master Slider version 3.10.6 or earlier are affected.
💻 Affected Systems
- Master Slider – Responsive Touch Slider WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to WordPress sites, steal sensitive user data, install backdoors, or redirect visitors to malicious sites, potentially compromising the entire website and its users.
Likely Case
Attackers with contributor access inject malicious scripts that steal session cookies from administrators or visitors, leading to account takeover and limited site defacement.
If Mitigated
With proper user access controls and content security policies, impact is limited to minor site defacement or script injection that doesn't execute due to CSP restrictions.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once an attacker has contributor-level credentials. Public proof-of-concept exists in vulnerability reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.10.7 or later
Vendor Advisory: https://wordpress.org/plugins/master-slider/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Master Slider plugin. 4. Click 'Update Now' if update is available. 5. If no update appears, manually download version 3.10.7+ from WordPress.org and replace plugin files.
🔧 Temporary Workarounds
Disable Master Slider Plugin
allTemporarily disable the vulnerable plugin until patching is possible
wp plugin deactivate master-slider
Restrict User Roles
allTemporarily remove contributor-level posting permissions or downgrade suspicious accounts
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Monitor and audit user accounts with contributor-level access or higher
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Master Slider → Version number. If version is 3.10.6 or lower, you are vulnerable.Check Version:
wp plugin get master-slider --field=versionVerify Fix Applied:
After updating, verify Master Slider version is 3.10.7 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to wp-admin/post.php with ms_layer shortcode parameters
- Multiple failed login attempts followed by successful contributor-level login
Network Indicators:
- Unexpected script tags in page responses containing ms_layer attributes
- External JavaScript loading from unusual domains in page content
SIEM Query:
source="wordpress.log" AND ("ms_layer" OR "master-slider") AND ("script" OR "javascript" OR "onclick")