CVE-2024-13773
📋 TL;DR
The Civi WordPress theme contains hard-coded LinkedIn API credentials in all versions up to 2.1.4, allowing unauthenticated attackers to extract sensitive authentication keys. This affects all WordPress sites using the vulnerable Civi theme versions.
💻 Affected Systems
- Civi - Job Board & Freelance Marketplace WordPress Theme
📦 What is this software?
Civi by Uxper
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to LinkedIn API credentials, potentially compromising associated LinkedIn accounts, harvesting user data, or performing unauthorized API operations.
Likely Case
Attackers extract LinkedIn client and secret keys, enabling them to make unauthorized API calls or potentially access LinkedIn account data.
If Mitigated
With proper network segmentation and API key monitoring, impact is limited to credential rotation and minor data exposure.
🎯 Exploit Status
Exploitation requires accessing the vulnerable file directly via HTTP request.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 2.1.4
Vendor Advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/e3499182-7501-4fec-a7c6-b66ae47533cd
Restart Required: No
Instructions:
1. Update Civi theme to latest version via WordPress admin panel. 2. Verify theme version is above 2.1.4. 3. Rotate all LinkedIn API credentials immediately.
🔧 Temporary Workarounds
Remove vulnerable file
allDelete or rename the vulnerable class-init.php file to prevent credential extraction
rm /path/to/wp-content/themes/civi/includes/class-init.php
Block file access via .htaccess
ApachePrevent direct access to the vulnerable PHP file using web server rules
<Files "class-init.php">
Order Allow,Deny
Deny from all
</Files>
🧯 If You Can't Patch
- Immediately rotate all LinkedIn API credentials used by the application
- Implement web application firewall rules to block access to /wp-content/themes/civi/includes/class-init.php
🔍 How to Verify
Check if Vulnerable:
Check if file wp-content/themes/civi/includes/class-init.php exists and contains hard-coded LinkedIn credentialsCheck Version:
Check WordPress admin panel > Appearance > Themes or examine style.css in theme folderVerify Fix Applied:
Verify theme version is above 2.1.4 and class-init.php no longer contains hard-coded credentials📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /wp-content/themes/civi/includes/class-init.php
- Unusual LinkedIn API activity from unexpected IPs
Network Indicators:
- Outbound connections to LinkedIn API from compromised servers
- Traffic patterns indicating credential harvesting
SIEM Query:
source="web_access_logs" AND uri="/wp-content/themes/civi/includes/class-init.php"