CVE-2024-3558
📋 TL;DR
The Custom Field Suite WordPress plugin versions up to 2.6.7 contain a stored cross-site scripting vulnerability in the 'cfs[post_title]' parameter. This allows authenticated attackers with contributor-level access or higher to inject malicious scripts that execute when users view compromised pages. WordPress sites using vulnerable plugin versions are affected.
💻 Affected Systems
- Custom Field Suite WordPress Plugin
📦 What is this software?
Custom Field Suite by Custom Field Suite Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, redirect users to malicious sites, deface websites, or perform actions on behalf of authenticated users.
Likely Case
Attackers with contributor access inject malicious scripts to steal session cookies or perform limited site defacement.
If Mitigated
With proper input validation and output escaping, no script execution occurs, though malicious content may still be stored.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once authentication is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.8
Vendor Advisory: https://en-gb.wordpress.org/plugins/custom-field-suite/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Custom Field Suite and click 'Update Now'. 4. Verify version is 2.6.8 or higher.
🔧 Temporary Workarounds
Remove Contributor Access
allTemporarily restrict contributor-level user roles until patching is complete.
Disable Plugin
allDeactivate Custom Field Suite plugin if not essential for site functionality.
🧯 If You Can't Patch
- Implement web application firewall rules to block XSS payloads in post_title parameters.
- Enable Content Security Policy headers to restrict script execution sources.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Custom Field Suite version. If version is 2.6.7 or lower, you are vulnerable.Check Version:
wp plugin list --name=custom-field-suite --field=versionVerify Fix Applied:
After updating, confirm Custom Field Suite version shows 2.6.8 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Unusual post creation/modification by contributor users
- POST requests containing script tags in cfs[post_title] parameter
Network Indicators:
- HTTP requests with suspicious script content in post_title parameters
SIEM Query:
source="wordpress.log" AND ("cfs[post_title]" AND ("<script" OR "javascript:" OR "onerror="))🔗 References
- https://core.trac.wordpress.org/ticket/56655
- https://en-gb.wordpress.org/plugins/custom-field-suite/
- https://github.com/WordPress/WordPress/blob/22d95abc55824e83904dc0fef290464b6bec7708/wp-admin/includes/template.php#L1384
- https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/api.php#L282
- https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/field_group.php#L20
- https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/form.php#L64
- https://mgibbs189.github.io/custom-field-suite/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4dc6fd-4bd5-4ed1-ade0-cf2f8831fac3?source=cve
- https://core.trac.wordpress.org/ticket/56655
- https://en-gb.wordpress.org/plugins/custom-field-suite/
- https://github.com/WordPress/WordPress/blob/22d95abc55824e83904dc0fef290464b6bec7708/wp-admin/includes/template.php#L1384
- https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/api.php#L282
- https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/field_group.php#L20
- https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/form.php#L64
- https://mgibbs189.github.io/custom-field-suite/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4dc6fd-4bd5-4ed1-ade0-cf2f8831fac3?source=cve
