CVE-2024-10793 is a critical security vulnerability identified in the WP Activity Log plugin for WordPress, specifically affecting versions up to and including 5.2.1. This vulnerability is categorized as an unauthenticated stored cross-site scripting (XSS) issue, which allows attackers to inject malicious scripts via the user_id parameter. The flaw arises from insufficient input sanitization and output escaping, making it possible for unauthenticated users to execute arbitrary web scripts on affected sites.

Details of the Vulnerability

• Vulnerability Type: Unauthenticated Stored Cross-Site Scripting (XSS)

curl -X POST 'http://example.com/wp-admin/admin-ajax.php' \
     -d 'action=destroy-sessions&user_id=<script>alert("XSS found 1")</script>'

• Affected Versions: WP Activity Log plugin versions ≤ 5.2.1
• CVSS Score: The vulnerability has been rated as problematic, indicating a medium to high severity level, although specific CVSS scores were not provided in the sources.
• Discovery and Reporting: The vulnerability was reported by researcher Mike Myers on November 14, 2024, and has since been patched in subsequent updates of the plugin.

Impact

The exploitation of this vulnerability can lead to various security issues, including:

• Unauthorized access to sensitive data
• Manipulation of website content
• Potential redirection of users to malicious sites

Attackers can leverage this vulnerability to execute scripts that could hijack user sessions, deface websites, or redirect users to phishing sites.

Mitigation

To mitigate the risk associated with CVE-2024-10793, it is crucial for users of the WP Activity Log plugin to take the following actions:

• Update the Plugin: Ensure that your WP Activity Log plugin is updated to the latest version beyond 5.2.1, where this vulnerability has been addressed.
• Regular Security Audits: Conduct regular audits of your WordPress installation and plugins to identify and remediate vulnerabilities promptly.
• Implement Security Best Practices: Utilize security plugins that monitor for suspicious activity and enforce strong access controls.

By staying updated and vigilant, WordPress administrators can significantly reduce the risk posed by vulnerabilities like CVE-2024-10793.

If you need help setting up server security, please contact us [email protected]