CVE-2024-13888
📋 TL;DR
The WPMobile.App WordPress plugin contains an open redirect vulnerability that allows unauthenticated attackers to redirect users to malicious websites. All WordPress sites using this plugin up to version 11.56 are affected. Attackers can exploit this by tricking users into clicking specially crafted links.
💻 Affected Systems
- WPMobile.App WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Users are redirected to phishing sites that steal credentials, financial information, or deliver malware, leading to account compromise, financial loss, or system infection.
Likely Case
Attackers use the redirect for phishing campaigns, credential harvesting, or delivering malicious content to users who trust the legitimate WordPress site.
If Mitigated
With proper user awareness training and web filtering, users avoid clicking suspicious links, limiting the attack's effectiveness to low-trust scenarios.
🎯 Exploit Status
Exploitation requires user interaction (clicking a link) but is technically simple for attackers to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 11.57 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3243366
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WPMobile.App plugin. 4. Click 'Update Now' if available, or manually update to version 11.57+. 5. Verify the plugin is active and functioning.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the WPMobile.App plugin until patched
Web Application Firewall rule
allBlock requests containing malicious redirect parameters
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to restrict redirect destinations
- Use web application firewall to filter and block suspicious redirect parameters
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for WPMobile.App version 11.56 or lowerCheck Version:
wp plugin list --name=wpappninja --field=versionVerify Fix Applied:
Confirm plugin version is 11.57 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- HTTP requests with 'redirect' parameter containing external domains
- Unusual redirect patterns in access logs
Network Indicators:
- Outbound redirects to unexpected domains
- Suspicious referrer patterns
SIEM Query:
web_access_logs WHERE url CONTAINS 'redirect=' AND url NOT CONTAINS 'wordpress.org' AND url NOT CONTAINS 'site_domain'