CVE-2024-3587 – This vulnerability allows authenticated WordPre... (How to Fix)

Q: What is the severity of CVE-2024-3587?

CVE-2024-3587 has a CVSS score of 6.4 (MEDIUM). This vulnerability allows authenticated WordPress users with contributor-level access or higher to inject malicious scripts into pages using the Premium Portfolio Features for Phlox theme plugin. The stored XSS executes when other users view the compromised pages, potentially leading to session hijacking, defacement, or malware distribution. All WordPress sites using this plugin up to version 2.3.2 are affected.

📋 TL;DR

This vulnerability allows authenticated WordPress users with contributor-level access or higher to inject malicious scripts into pages using the Premium Portfolio Features for Phlox theme plugin. The stored XSS executes when other users view the compromised pages, potentially leading to session hijacking, defacement, or malware distribution. All WordPress sites using this plugin up to version 2.3.2 are affected.

💻 Affected Systems

Products:

Premium Portfolio Features for Phlox (auxin-portfolio) WordPress plugin

Versions: All versions up to and including 2.3.2

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user with at least contributor role. WordPress multisite installations are also affected.

📦 What is this software?

Auxinportfolio by Averta

View all CVEs affecting Auxinportfolio →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, install backdoors, redirect users to malicious sites, or completely compromise the WordPress site and potentially the underlying server.

🟠

Likely Case

Session hijacking, defacement of website pages, or injection of cryptocurrency miners or adware scripts affecting visitors.

🟢

If Mitigated

Limited to defacement of specific portfolio pages with minimal data exposure if proper content security policies and user role restrictions are in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires contributor-level access but is straightforward once authenticated. Public proof-of-concept exists in vulnerability reports.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.3.3 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3115537/auxin-portfolio/trunk/public/templates/elements/recent-portfolio.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Premium Portfolio Features for Phlox' plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 2.3.3+ from WordPress repository and replace plugin files.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the auxin-portfolio plugin until patched

wp plugin deactivate auxin-portfolio

Restrict user roles

all

Remove contributor and author roles from untrusted users

wp user remove-role <username> contributor
wp user remove-role <username> author

🧯 If You Can't Patch

Implement Content Security Policy (CSP) headers to restrict script execution
Install web application firewall (WAF) with XSS protection rules

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins > Installed Plugins. If version is 2.3.2 or lower, you are vulnerable.

Check Version:

wp plugin get auxin-portfolio --field=version

Verify Fix Applied:

Verify plugin version is 2.3.3 or higher. Test portfolio widget functionality to ensure it still works properly.

📡 Detection & Monitoring

Log Indicators:

Unusual portfolio widget modifications by contributor-level users
Multiple failed XSS attempts in web server logs

Network Indicators:

Unexpected script tags in portfolio page responses
External script loads from portfolio pages

SIEM Query:

source="wordpress.log" AND "auxin-portfolio" AND ("update" OR "edit" OR "save") AND user_role="contributor"

📊 Metadata

CVE ID: CVE-2024-3587

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

Published: July 16, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-3587, you might also want to check these: