CVE-2024-8119
📋 TL;DR
This vulnerability allows unauthenticated attackers to inject malicious scripts via the page parameter in the WP Extended WordPress plugin. When a user clicks a specially crafted link, the script executes in their browser, potentially stealing cookies or session data. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- The Ultimate WordPress Toolkit – WP Extended
📦 What is this software?
Wp Extended by Wpextended
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain administrative access to WordPress, install backdoors, deface websites, or exfiltrate sensitive data.
Likely Case
Attackers steal user session cookies, perform actions as those users, or redirect users to malicious sites.
If Mitigated
Script execution is blocked by Content Security Policy or browser XSS filters, limiting impact to minor data leakage.
🎯 Exploit Status
Reflected XSS requires tricking users into clicking malicious links but requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.9 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'The Ultimate WordPress Toolkit – WP Extended'. 4. Click 'Update Now' if available. 5. If not, download version 3.0.9+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate wpextended
Web Application Firewall Rule
allBlock requests containing malicious script patterns in the page parameter.
🧯 If You Can't Patch
- Implement Content Security Policy headers to restrict script execution.
- Use browser security extensions that block reflected XSS attacks.
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins > Installed Plugins. If version is 3.0.8 or lower, you are vulnerable.Check Version:
wp plugin get wpextended --field=versionVerify Fix Applied:
Confirm plugin version is 3.0.9 or higher after update.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with page parameter containing script tags or JavaScript code
- Unusual referrer URLs with encoded payloads
Network Indicators:
- GET requests with suspicious parameters like ?page=<script>
- Traffic patterns showing users clicking on external links then immediately accessing admin pages
SIEM Query:
http.url:*page=* AND (http.url:*<script>* OR http.url:*javascript:* OR http.url:*onerror=*)🔗 References
- https://plugins.trac.wordpress.org/browser/wpextended/trunk/includes/modules/core_extensions/wpext_snippets/wp-extend-module-listing.php#L216
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3145430%40wpextended%2Ftrunk&old=3134345%40wpextended%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/50798706-ad0d-431e-ac5f-57a0606c6f94?source=cve
