CVE-2024-3588
📋 TL;DR
The Getwid WordPress plugin's Countdown block has a stored XSS vulnerability allowing authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when users view the compromised pages, potentially stealing session cookies or redirecting to malicious sites. All WordPress sites using Getwid versions up to 2.0.7 are affected.
💻 Affected Systems
- Getwid – Gutenberg Blocks WordPress plugin
📦 What is this software?
Getwid by Motopress
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, take over the WordPress site, install backdoors, deface pages, or redirect visitors to malware distribution sites.
Likely Case
Attackers inject malicious JavaScript to steal user session cookies, potentially compromising user accounts and performing actions on their behalf.
If Mitigated
With proper user role management and content review processes, impact is limited to potential defacement of specific pages rather than full site compromise.
🎯 Exploit Status
Exploit requires authenticated user with at least contributor privileges. Public proof-of-concept available in GitHub pull request.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.8
Vendor Advisory: https://wordpress.org/plugins/getwid/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Getwid plugin and click 'Update Now'. 4. Verify plugin version shows 2.0.8 or higher.
🔧 Temporary Workarounds
Disable Getwid plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate getwid
Restrict user roles
allTemporarily remove contributor-level access for untrusted users
🧯 If You Can't Patch
- Implement strict content review process for all posts/pages created by contributors
- Install web application firewall with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins → Getwid version. If version is 2.0.7 or lower, you are vulnerable.Check Version:
wp plugin get getwid --field=versionVerify Fix Applied:
After updating, verify Getwid version shows 2.0.8 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual post/page edits by contributor-level users
- JavaScript injection in post_content fields
Network Indicators:
- Suspicious outbound connections from WordPress pages to unknown domains
SIEM Query:
source="wordpress" AND (event="post_modified" OR event="page_modified") AND user_role="contributor" AND content CONTAINS "<script>"🔗 References
- https://github.com/motopress/getwid/pull/123/files#diff-042442d51783880aea585ad052aae32346491ed600f83b950955084a96a6e030
- https://plugins.trac.wordpress.org/browser/getwid/trunk/assets/blocks/counter/frontend.js
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3077603%40getwid&new=3077603%40getwid&sfp_email=&sfph_mail=#file7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c4770184-1b96-490c-b506-f648ab3ed764?source=cve
- https://github.com/motopress/getwid/pull/123/files#diff-042442d51783880aea585ad052aae32346491ed600f83b950955084a96a6e030
- https://plugins.trac.wordpress.org/browser/getwid/trunk/assets/blocks/counter/frontend.js
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3077603%40getwid&new=3077603%40getwid&sfp_email=&sfph_mail=#file7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c4770184-1b96-490c-b506-f648ab3ed764?source=cve
