CVE-2024-29138 Scanner
CVE-2024-29138 Scanner - Cross-Site Scripting (XSS) vulnerability in WordPress Restrict User Access
Short Info
Level
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
2 weeks 19 hours
Scan only one
Domain, Subdomain, IPv4
Toolbox
WordPress Restrict User Access is a membership plugin widely used in WordPress websites to manage user permissions and access levels. It is designed for administrators and webmasters to efficiently set up membership sites and manage user roles. The plugin is popular among developers due to its flexibility and integration capabilities with other WordPress features. Its primary purpose is to grant or restrict access to certain areas of a website based on user roles. It helps businesses and websites to provide exclusive content to members, enhancing user engagement. The plugin's simplicity and powerful functionalities make it a preferred choice for many WordPress users.
The Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. This vulnerability specifically targets the '_rua_section' parameter in the admin level edit page. If exploited, attackers can execute arbitrary scripts on authenticated admin browsers. This could lead to session hijacking, privilege escalation, and potentially take over WordPress admin accounts. The vulnerability poses a significant threat to website security if left unpatched. It is crucial to address this vulnerability to prevent unauthorized actions and data breaches.
The vulnerability is due to insufficient input validation on the '_rua_section' parameter, which can be manipulated to include malicious script tags. The susceptible end-point is within the WordPress admin dashboard, accessible at '/wp-admin/admin.php?page=wprua-level&action=edit'. This parameter can be exploited by crafting a request that includes script code embedded within SVG elements. The exploitation is possible through authenticated access to the admin panel, which highlights the necessity for stringent input validation. Attackers can leverage this vulnerability to manipulate the DOM and execute undesired scripts.
Exploiting this vulnerability could allow attackers to perform a range of malicious activities. These include hijacking user sessions, escalating privileges, installing malicious plugins, or even defacing the website. In extreme cases, the vulnerability could lead to a complete compromise of the WordPress admin account, allowing attackers full control over the website. Such actions not only jeopardize website security but can also impact the reputation and trustworthiness of the platform. The cascading effects could result in data theft, financial loss, and legal implications for affected site administrators.
REFERENCES
