CVE-2024-3307 – This vulnerability allows authenticated WordPre... (How to Fix)

Q: What is the severity of CVE-2024-3307?

CVE-2024-3307 has a CVSS score of 6.4 (MEDIUM). This vulnerability allows authenticated WordPress users with contributor-level access or higher to inject malicious scripts into pages using the HT Mega plugin's Countdown widget. The scripts are stored and execute whenever users view the compromised pages, potentially affecting all visitors. This affects all WordPress sites using HT Mega plugin versions up to 2.4.9.

📋 TL;DR

This vulnerability allows authenticated WordPress users with contributor-level access or higher to inject malicious scripts into pages using the HT Mega plugin's Countdown widget. The scripts are stored and execute whenever users view the compromised pages, potentially affecting all visitors. This affects all WordPress sites using HT Mega plugin versions up to 2.4.9.

💻 Affected Systems

Products:

HT Mega - Absolute Addons For Elementor WordPress plugin

Versions: All versions up to and including 2.4.9

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress with Elementor page builder and the HT Mega plugin installed. The Countdown widget must be in use on at least one page.

📦 What is this software?

Ht Mega by Hasthemes

View all CVEs affecting Ht Mega →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal session cookies, redirect users to malicious sites, deface websites, or perform actions on behalf of authenticated users, potentially leading to full site compromise.

🟠

Likely Case

Attackers with contributor access inject malicious scripts to steal user data, display unwanted content, or redirect visitors to phishing sites.

🟢

If Mitigated

With proper user access controls and content security policies, impact is limited to potential defacement of specific pages containing the vulnerable widget.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires contributor-level WordPress access. The vulnerability is in the Countdown widget's attribute handling, making injection straightforward for authenticated attackers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.5.0 and later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3071480%40ht-mega-for-elementor%2Ftrunk&old=3063395%40ht-mega-for-elementor%2Ftrunk

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'HT Mega - Absolute Addons For Elementor'. 4. Click 'Update Now' if available, or manually update to version 2.5.0+. 5. Clear any caching plugins or CDN caches.

🔧 Temporary Workarounds

Remove Contributor Access

all

Temporarily restrict contributor-level users from creating or editing posts until patched.

Disable Countdown Widget

all

Remove or disable the Countdown widget from all pages if immediate patching isn't possible.

🧯 If You Can't Patch

Implement strict Content Security Policy (CSP) headers to limit script execution
Review and audit all user accounts with contributor access or higher

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin > Plugins > Installed Plugins for HT Mega version. If version is 2.4.9 or lower, you are vulnerable.

Check Version:

wp plugin list --name='ht-mega-for-elementor' --field=version

Verify Fix Applied:

After updating, verify the plugin version shows 2.5.0 or higher in WordPress admin.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to WordPress admin-ajax.php with Countdown widget parameters
Multiple page edits by contributor users in short timeframes

Network Indicators:

Script tags with unusual attributes in Countdown widget HTML output
External script loads from unexpected domains on pages with Countdown widgets

SIEM Query:

source="wordpress.log" AND ("htmega_countdown" OR "Countdown widget") AND ("script" OR "onclick" OR "onload")

📊 Metadata

CVE ID: CVE-2024-3307

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: May 2, 2024

Last Updated: January 28, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-3307, you might also want to check these: