CVE-2024-6499
📋 TL;DR
The MaxButtons WordPress plugin exposes full server path information to unauthenticated attackers in versions up to 9.7.8. This information disclosure vulnerability allows attackers to gather reconnaissance data that could facilitate other attacks. All WordPress sites using vulnerable versions of the MaxButtons plugin are affected.
💻 Affected Systems
- WordPress MaxButtons Plugin
📦 What is this software?
Maxbuttons by Maxfoundry
⚠️ Risk & Real-World Impact
Worst Case
Attackers combine path disclosure with other vulnerabilities (like local file inclusion) to achieve remote code execution or sensitive data exposure.
Likely Case
Attackers use the path information to simplify reconnaissance and target other vulnerabilities more effectively.
If Mitigated
Limited to path disclosure only, which provides minimal useful information on its own.
🎯 Exploit Status
Simple HTTP request to vulnerable endpoint reveals path information.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.8.0
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3140369/maxbuttons/tags/9.8.0/assets/libraries/font-awesome-5/convert.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find MaxButtons plugin. 4. Click 'Update Now' if available, or manually update to version 9.8.0+. 5. Verify update completed successfully.
🔧 Temporary Workarounds
Disable vulnerable endpoint
allBlock access to the vulnerable convert.php file via web server configuration.
# For Apache: add to .htaccess
<Files "convert.php">
Require all denied
</Files>
# For Nginx: add to server block
location ~* /convert\.php$ {
deny all;
return 403;
}
🧯 If You Can't Patch
- Disable the MaxButtons plugin entirely until patched.
- Implement web application firewall rules to block requests to vulnerable endpoints.
🔍 How to Verify
Check if Vulnerable:
Access https://[your-site]/wp-content/plugins/maxbuttons/assets/libraries/font-awesome-5/convert.php - if it returns server path information, you're vulnerable.Check Version:
Check WordPress admin panel → Plugins → MaxButtons, or examine /wp-content/plugins/maxbuttons/readme.txt file version header.Verify Fix Applied:
After updating to 9.8.0+, access the same URL - it should return a 403 error or blank page instead of path information.📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to /convert.php endpoints
- Unusual requests to font-awesome-5 directory
Network Indicators:
- GET requests to /wp-content/plugins/maxbuttons/assets/libraries/font-awesome-5/convert.php
SIEM Query:
url:*/convert.php AND (http_response_code:200 OR user_agent:*scan* OR user_agent:*curl*)🔗 References
- https://plugins.trac.wordpress.org/browser/maxbuttons/trunk/assets/libraries/font-awesome-5/convert.php
- https://plugins.trac.wordpress.org/changeset/3140369/maxbuttons/tags/9.8.0/assets/libraries/font-awesome-5/convert.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd0694c-ea7e-4cf8-a8d8-82a2b02fecdf?source=cve
