CVE-2024-7655
📋 TL;DR
This vulnerability allows authenticated attackers with administrator-level access to inject malicious scripts into WordPress pages using the PeepSo plugin. The scripts execute when users visit the compromised pages, potentially stealing credentials or performing unauthorized actions. Only multi-site WordPress installations or those with unfiltered_html disabled are affected.
💻 Affected Systems
- PeepSo - Social Network, Membership, Registration, User Profiles WordPress plugin
📦 What is this software?
Peepso by Peepso
⚠️ Risk & Real-World Impact
Worst Case
Administrator account compromise leading to full site takeover, data theft, or malware distribution to visitors.
Likely Case
Session hijacking, credential theft, or defacement of affected pages by malicious administrators.
If Mitigated
Limited impact due to requiring administrator access and specific WordPress configurations.
🎯 Exploit Status
Requires administrator-level authenticated access and specific WordPress configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.4.6.0
Vendor Advisory: https://www.peepso.com/6-4-6-0/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find PeepSo plugin. 4. Click 'Update Now' or manually update to version 6.4.6.0+. 5. Verify update completes successfully.
🔧 Temporary Workarounds
Disable unfiltered_html capability
allEnable unfiltered_html capability for administrators to prevent exploitation (if currently disabled).
Add define('DISALLOW_UNFILTERED_HTML', false); to wp-config.php
Restrict administrator accounts
allLimit administrator accounts to trusted users only and implement strong access controls.
🧯 If You Can't Patch
- Remove administrator access from untrusted users immediately.
- Implement web application firewall (WAF) rules to block XSS payloads.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > PeepSo version. If version is 6.4.5.0 or lower, you are vulnerable.Check Version:
wp plugin list --name=peepso-core --field=versionVerify Fix Applied:
Confirm PeepSo plugin version is 6.4.6.0 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual administrator activity, unexpected script tags in page content, or POST requests with script payloads to admin endpoints.
Network Indicators:
- Suspicious JavaScript in HTTP responses from WordPress pages.
SIEM Query:
source="wordpress.log" AND ("script" OR "javascript" OR "onload" OR "onerror") AND "admin"🔗 References
- https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.6.0/classes/adminconfigfields.php?rev=3147528#L17
- https://plugins.trac.wordpress.org/changeset/3147528/
- https://wordpress.org/plugins/peepso-core/#developers
- https://www.peepso.com/6-4-6-0/
- https://www.peepso.com/changelog/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e85ee611-ae81-4736-b4f0-b9d06714da18?source=cve
