CVE-2024-43935
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into WordPress sites using the Delicious Recipes plugin. When executed, these scripts can steal user credentials, hijack sessions, or deface websites. All WordPress sites running Delicious Recipes plugin versions up to 1.6.7 are affected.
💻 Affected Systems
- Delicious Recipes – WordPress Recipe Plugin
📦 What is this software?
Wp Delicious by Wpdelicious
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover, credential theft for all users, malware distribution to visitors, and persistent website defacement.
Likely Case
Session hijacking for logged-in users, credential theft via fake login forms, and website defacement affecting user trust.
If Mitigated
Limited impact with proper input validation and output encoding, potentially only affecting specific plugin functionality.
🎯 Exploit Status
XSS vulnerabilities in WordPress plugins are commonly exploited. While no public PoC is confirmed, similar vulnerabilities are frequently weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.8 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Delicious Recipes' and click 'Update Now'. 4. Verify version is 1.6.8 or higher.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate delicious-recipes
Implement WAF Rules
allAdd XSS protection rules to web application firewall
# Add XSS filter rules to your WAF configuration
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Enable WordPress security plugins with XSS protection features
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Delicious Recipes → Version. If version is 1.6.7 or lower, you are vulnerable.Check Version:
wp plugin get delicious-recipes --field=versionVerify Fix Applied:
After updating, verify version shows 1.6.8 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to recipe-related endpoints
- Script tags in recipe content submissions
- Multiple failed login attempts following recipe submissions
Network Indicators:
- Malicious script payloads in HTTP requests
- Unexpected outbound connections from recipe pages
SIEM Query:
source="wordpress.log" AND ("delicious-recipes" OR "recipe") AND ("script" OR "javascript:" OR "onerror=" OR "onload=")