CVE-2024-31380 – This vulnerability allows authenticated attacke... (How to Fix)

Q: What is the severity of CVE-2024-31380?

CVE-2024-31380 has a CVSS score of 9.9 (CRITICAL). This vulnerability allows authenticated attackers to execute arbitrary code on WordPress sites using Oxygen Builder. It affects all versions up to 4.9, enabling remote code execution through improper input validation.

📋 TL;DR

This vulnerability allows authenticated attackers to execute arbitrary code on WordPress sites using Oxygen Builder. It affects all versions up to 4.9, enabling remote code execution through improper input validation.

💻 Affected Systems

Products:

Soflyy Oxygen Builder WordPress Plugin

Versions: All versions up to and including 4.9

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user access; affects all WordPress installations using vulnerable Oxygen Builder versions.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server compromise leading to data theft, malware deployment, or site defacement.

🟠

Likely Case

Unauthorized code execution allowing backdoor installation, data exfiltration, or privilege escalation.

🟢

If Mitigated

Limited impact if proper authentication controls and input validation are in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access; detailed technical analysis available in public disclosures.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: None

Vendor Advisory: None

Restart Required: No

Instructions:

No official patch available as vendor is ignoring the vulnerability report.

🔧 Temporary Workarounds

Disable Oxygen Builder Plugin

all

Completely remove the vulnerable plugin from WordPress installation.

wp plugin deactivate oxygen
wp plugin delete oxygen

Restrict User Access

all

Limit authenticated user accounts and implement strong access controls.

🧯 If You Can't Patch

Implement web application firewall (WAF) rules to block code injection patterns
Monitor for suspicious PHP execution and file upload activities

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel for Oxygen Builder plugin version 4.9 or earlier.

Check Version:

wp plugin get oxygen --field=version

Verify Fix Applied:

Confirm Oxygen Builder is either disabled/removed or replaced with alternative page builder.

📡 Detection & Monitoring

Log Indicators:

Unusual PHP execution patterns
Suspicious file uploads to Oxygen Builder directories
Authentication logs showing unauthorized access attempts

Network Indicators:

Unexpected outbound connections from WordPress server
Suspicious POST requests to Oxygen Builder endpoints

SIEM Query:

source="wordpress.log" AND ("oxygen" OR "code injection") AND status=200

📊 Metadata

CVE ID: CVE-2024-31380

CVSS v3 Score: 9.9 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-94

Published: April 3, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-31380, you might also want to check these: