CVE-2024-13895
📋 TL;DR
The Code Snippets CPT WordPress plugin allows authenticated attackers with Subscriber-level access or higher to execute arbitrary shortcodes due to improper input validation. This vulnerability affects all versions up to and including 2.1.0, potentially enabling attackers to perform unauthorized actions within WordPress.
💻 Affected Systems
- WordPress Code Snippets CPT plugin
📦 What is this software?
Code Snippets Cpt by Jtsternberg
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute malicious shortcodes to create backdoors, escalate privileges, exfiltrate data, or compromise the entire WordPress site.
Likely Case
Attackers with subscriber accounts could execute unauthorized shortcodes to modify content, inject ads, redirect users, or perform limited administrative actions.
If Mitigated
With proper access controls and monitoring, impact is limited to content manipulation by authenticated users.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.1 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3076155%40code-snippets-cpt&new=3076155%40code-snippets-cpt
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Code Snippets CPT' and click 'Update Now'. 4. Verify version is 2.1.1 or higher.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the Code Snippets CPT plugin until patched
wp plugin deactivate code-snippets-cpt
Restrict user registration
allDisable new user registration to prevent attacker account creation
wp option update users_can_register 0
🧯 If You Can't Patch
- Remove Subscriber role from all users and assign minimal necessary permissions
- Implement web application firewall rules to block suspicious shortcode execution attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Code Snippets CPT → Version. If version is 2.1.0 or lower, system is vulnerable.Check Version:
wp plugin get code-snippets-cpt --field=versionVerify Fix Applied:
Verify plugin version is 2.1.1 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual shortcode execution patterns in WordPress debug logs
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- HTTP POST requests to wp-admin/admin-ajax.php with suspicious shortcode parameters
SIEM Query:
source="wordpress.log" AND "do_shortcode" AND ("action=code_snippets_cpt" OR "code-snippets-cpt")