CVE-2024-6870
📋 TL;DR
The Responsive Lightbox & Gallery WordPress plugin up to version 2.4.7 has a stored XSS vulnerability in its file upload functionality. Authenticated attackers with Author privileges or higher can upload malicious 3gp2 files containing JavaScript that executes when users view the file. This affects all WordPress sites using vulnerable versions of this plugin.
💻 Affected Systems
- Responsive Lightbox & Gallery WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal admin credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.
Likely Case
Attackers with Author accounts inject malicious scripts to steal session cookies or redirect users to phishing pages.
If Mitigated
With proper user role management and file upload restrictions, impact is limited to content manipulation within Author privileges.
🎯 Exploit Status
Exploitation requires authenticated access with Author privileges. The vulnerability is in a publicly accessible AJAX endpoint with insufficient input validation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.8
Vendor Advisory: https://wordpress.org/plugins/responsive-lightbox/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Responsive Lightbox & Gallery'. 4. Click 'Update Now' if available, or manually update to version 2.4.8+. 5. Verify update completes successfully.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate responsive-lightbox
Restrict user roles
allReview and minimize users with Author or higher privileges
🧯 If You Can't Patch
- Implement strict file upload restrictions to block 3gp2 files
- Add web application firewall rules to detect and block XSS payloads in file uploads
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for 'Responsive Lightbox & Gallery' version 2.4.7 or lowerCheck Version:
wp plugin get responsive-lightbox --field=versionVerify Fix Applied:
Verify plugin version is 2.4.8 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /wp-admin/admin-ajax.php with action=rl_upload_image
- Multiple failed upload attempts with 3gp2 files
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with file uploads containing script tags
SIEM Query:
source="wordpress.log" AND ("rl_upload_image" OR "3gp2") AND ("script" OR "javascript" OR "onload=")🔗 References
- https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.4.7/includes/class-remote-library.php#L261
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3137531%40responsive-lightbox&new=3137531%40responsive-lightbox&sfp_email=&sfph_mail=
- https://wordpress.org/plugins/responsive-lightbox/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d55309-d178-4b3d-9de6-2cf2769b76fe?source=cve
