CVE-2024-13797
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary WordPress shortcodes in the PressMart theme. Attackers can potentially inject malicious code, create backdoors, or manipulate site content. All WordPress sites using PressMart theme versions up to 1.2.16 are affected.
💻 Affected Systems
- PressMart - Modern Elementor WooCommerce WordPress Theme
📦 What is this software?
Pressmart by Presslayouts
⚠️ Risk & Real-World Impact
Worst Case
Complete site compromise through remote code execution, data theft, defacement, or malware injection via malicious shortcodes.
Likely Case
Content manipulation, privilege escalation, or backdoor installation through carefully crafted shortcodes.
If Mitigated
Limited to content injection if shortcode execution is restricted and proper input validation is in place.
🎯 Exploit Status
Attack requires no authentication and shortcode execution is straightforward once the vulnerability is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.2.17 or later
Vendor Advisory: https://themeforest.net/item/pressmart-modern-elementor-woocommerce-wordpress-theme/39241221
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Appearance > Themes. 3. Update PressMart theme to version 1.2.17 or later. 4. Clear any caching plugins/CDN caches.
🔧 Temporary Workarounds
Disable vulnerable theme
allSwitch to a different WordPress theme temporarily until patch is applied
Restrict access
allUse web application firewall rules to block suspicious shortcode execution attempts
🧯 If You Can't Patch
- Implement strict input validation for all user-controlled parameters
- Deploy web application firewall with rules to detect and block shortcode injection attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Appearance > Themes > PressMart theme version. If version is 1.2.16 or lower, system is vulnerable.Check Version:
wp theme list --field=name,version | grep pressmartVerify Fix Applied:
Confirm PressMart theme version is 1.2.17 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual shortcode execution patterns in WordPress debug logs
- Multiple failed authentication attempts followed by theme-related actions
Network Indicators:
- HTTP POST requests containing shortcode parameters to theme-specific endpoints
- Unusual traffic to /wp-content/themes/pressmart/
SIEM Query:
source="wordpress" AND (shortcode_execution OR theme="pressmart")