CVE-2024-4899
📋 TL;DR
This vulnerability in the SEOPress WordPress plugin allows high-privilege users (like contributors) to inject malicious scripts into post settings. When other users view affected posts, the scripts execute in their browsers. Only WordPress sites using vulnerable SEOPress versions are affected.
💻 Affected Systems
- SEOPress WordPress Plugin
📦 What is this software?
Seopress by Seopress
⚠️ Risk & Real-World Impact
Worst Case
A compromised contributor account could inject persistent XSS payloads that steal admin credentials, redirect users to malicious sites, or perform actions as authenticated users.
Likely Case
Malicious contributors could deface posts, inject ads, or steal session cookies from users viewing affected posts.
If Mitigated
With proper user access controls and content security policies, impact is limited to minor content manipulation within contributor privileges.
🎯 Exploit Status
Exploitation requires contributor-level access. Proof of concept is publicly available via WPScan.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.8 and later
Vendor Advisory: https://wpscan.com/vulnerability/15346ae9-9a29-4968-a6a9-81d1116ac448/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find SEOPress and click 'Update Now'. 4. Verify version is 7.8 or higher.
🔧 Temporary Workarounds
Temporarily disable plugin
allDeactivate SEOPress plugin until patched
wp plugin deactivate wp-seopress
Restrict contributor capabilities
allTemporarily remove contributor ability to edit posts
Use WordPress role editor plugin or custom code to modify capabilities
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Audit and monitor contributor account activity for suspicious post edits
🔍 How to Verify
Check if Vulnerable:
Check SEOPress plugin version in WordPress admin under Plugins > Installed PluginsCheck Version:
wp plugin get wp-seopress --field=versionVerify Fix Applied:
Confirm SEOPress version is 7.8 or higher in plugin details📡 Detection & Monitoring
Log Indicators:
- Unusual post edits by contributor accounts
- Script tags in post_content or postmeta tables
Network Indicators:
- Unexpected external script loads from WordPress posts
SIEM Query:
source="wordpress.log" AND "post_modified" AND user_role="contributor" AND ("script" OR "javascript" OR "onclick")