CVE-2024-10899 Overview
CVE-2024-10899 affects the WooCommerce Product Table Lite plugin for WordPress in all versions up to and including 3.8.6. The plugin fails to validate the id parameter before passing it to do_shortcode, allowing unauthenticated attackers to execute arbitrary WordPress shortcodes. The same id parameter is also vulnerable to Reflected Cross-Site Scripting (XSS). The flaw is classified under [CWE-94] (Improper Control of Generation of Code) and stems from insufficient input validation in an AJAX action exposed to unauthenticated users.
Critical Impact
Unauthenticated remote attackers can execute arbitrary shortcodes and reflected JavaScript through the id parameter, enabling content injection and session theft against site visitors.
Affected Products
- WooCommerce Product Table Lite plugin for WordPress
- All versions from initial release through 3.8.6 (inclusive)
- WordPress sites running the wc-product-table-lite plugin in default configuration
Discovery Timeline
- 2024-11-20 - CVE-2024-10899 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10899
Vulnerability Analysis
The WooCommerce Product Table Lite plugin registers an action handler that accepts a user-supplied id parameter and forwards it to WordPress's do_shortcode() function without validating that the value corresponds to a legitimate plugin shortcode. Because the handler is accessible without authentication, any visitor can trigger shortcode execution by crafting a single HTTP request. The vulnerable code path resides in main.php around line 1778 of the 3.8.6 release. Attackers can invoke any registered shortcode on the site, including shortcodes that expose privileged functionality, leak data, or render attacker-controlled markup. Because the same id value is reflected into the response, attackers can also inject JavaScript that executes in a victim's browser session.
Root Cause
The root cause is improper input validation [CWE-94]. The plugin treats the id request parameter as a trusted shortcode identifier and passes it directly to do_shortcode(). No allowlist, type check, or capability check restricts which shortcodes can be invoked or who can invoke them.
Attack Vector
Exploitation occurs over the network with no authentication and no user interaction. An attacker sends a crafted HTTP request to the vulnerable AJAX endpoint containing a malicious id value. The server executes the supplied shortcode and reflects the parameter back into the HTTP response. For the XSS variant, the attacker delivers a link to a victim, causing arbitrary script execution under the site's origin.
No verified public proof-of-concept code is available. See the Wordfence Vulnerability Report and the WordPress Plugin Code Review for the affected source.
Detection Methods for CVE-2024-10899
Indicators of Compromise
- HTTP requests to admin-ajax.php or plugin endpoints containing an id parameter with shortcode syntax such as [, ], or known WordPress shortcode names
- Reflected id parameter values containing <script>, onerror=, javascript:, or HTML entity-encoded JavaScript payloads
- Unexpected outbound requests originating from the WordPress host immediately after shortcode-handler invocations
- Spikes of unauthenticated GET or POST traffic targeting the wc-product-table-lite action handler
Detection Strategies
- Inspect web server access logs for requests where the id query string parameter contains square brackets, angle brackets, or URL-encoded equivalents (%5B, %3C)
- Deploy WAF signatures that flag shortcode patterns or HTML tags inside the id parameter of plugin AJAX endpoints
- Audit installed WordPress plugins and compare against the vulnerable version range (<= 3.8.6)
Monitoring Recommendations
- Forward WordPress and reverse proxy access logs to a centralized analytics platform and alert on unauthenticated invocations of plugin AJAX actions
- Monitor for new administrative users, modified wp_options entries, or unexpected file changes on WordPress hosts that run the affected plugin
- Track browser-side error reports and Content Security Policy (CSP) violations that indicate reflected script execution
How to Mitigate CVE-2024-10899
Immediate Actions Required
- Update the WooCommerce Product Table Lite plugin to a version released after 3.8.6 that addresses the shortcode execution and XSS flaws
- Disable or remove the plugin until a patched release is verified in non-production
- Apply WAF rules that block shortcode delimiters and HTML markup inside the id parameter on plugin endpoints
- Review WordPress audit logs for unauthenticated invocations of the vulnerable handler since the plugin was installed
Patch Information
The vendor addressed the issue in a subsequent plugin release. Refer to the WordPress Changeset Details for the upstream fix and to the Wordfence Vulnerability Report for vendor coordination details.
Workarounds
- Restrict access to wp-admin/admin-ajax.php for unauthenticated users where business logic permits, or limit the specific plugin action via a WAF policy
- Enforce a strict Content Security Policy that blocks inline script execution to reduce reflected XSS impact
- Deactivate the WooCommerce Product Table Lite plugin until the upgrade is applied and verified
# Example WordPress CLI commands to identify and disable the vulnerable plugin
wp plugin list --name=wc-product-table-lite --fields=name,status,version
wp plugin deactivate wc-product-table-lite
wp plugin update wc-product-table-lite
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
