CVE-2024-8254
📋 TL;DR
This vulnerability allows authenticated WordPress users with Subscriber-level access or higher to execute arbitrary shortcodes through the Email Subscribers plugin. Attackers can potentially inject malicious shortcodes that execute unauthorized actions or access sensitive data. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- Email Subscribers by Icegram Express WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary PHP code, leading to complete site compromise, data theft, or malware installation through malicious shortcode execution.
Likely Case
Attackers with subscriber accounts could inject shortcodes that modify content, redirect users, or perform unauthorized actions within WordPress capabilities.
If Mitigated
With proper access controls and monitoring, impact is limited to content manipulation by authenticated users.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once an attacker has subscriber credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.7.35
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3157336/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Email Subscribers by Icegram Express'. 4. Click 'Update Now' if available, or manually update to version 5.7.35+. 5. Verify update completes successfully.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the Email Subscribers plugin until patched
wp plugin deactivate email-subscribers
Restrict user registration
allDisable new user registration to prevent attacker account creation
wp option update users_can_register 0
🧯 If You Can't Patch
- Implement strict access controls and monitor subscriber account activity
- Disable shortcode execution for subscriber roles using security plugins
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Email Subscribers version. If version is 5.7.34 or lower, system is vulnerable.Check Version:
wp plugin get email-subscribers --field=versionVerify Fix Applied:
Verify plugin version is 5.7.35 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual shortcode execution in WordPress debug logs
- Multiple failed login attempts followed by shortcode-related actions
Network Indicators:
- HTTP POST requests to wp-admin/admin-ajax.php with shortcode parameters
SIEM Query:
source="wordpress" AND ("do_shortcode" OR "es_common") AND status=200