CVE-2024-11977: kk Star Ratings WordPress RCE Vulnerability

CVE-2024-11977 Overview

CVE-2024-11977 affects the kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress in all versions up to and including 5.4.10. The plugin fails to validate a user-supplied value before passing it to do_shortcode, allowing unauthenticated attackers to execute arbitrary WordPress shortcodes. The flaw is categorized under CWE-94: Improper Control of Generation of Code. Version 5.4.10.1 only partially addressed the issue, and a complete fix shipped in 5.4.10.2.

Critical Impact
Unauthenticated attackers can trigger arbitrary shortcode execution on affected WordPress sites, enabling content disclosure, abuse of installed plugin functionality, and potential interaction chains depending on which shortcodes are registered.

Affected Products

kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress, all versions ≤ 5.4.10
kk Star Ratings 5.4.10.1 (partial patch — still vulnerable)
WordPress sites running kk Star Ratings prior to 5.4.10.2

Discovery Timeline

2024-12-21 - CVE-2024-11977 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-11977

Vulnerability Analysis

The plugin exposes an AJAX action handler in wp_ajax_kk-star-ratings.php that accepts a user-controlled value and forwards it to WordPress's do_shortcode function without sufficient validation. Because the AJAX endpoint is reachable without authentication, any remote visitor can submit crafted input and force the server to expand arbitrary shortcodes registered on the site.

Shortcodes in WordPress are server-side macros that can return rendered HTML, query data, or invoke plugin logic. When attacker-controlled strings reach do_shortcode, the attacker effectively gains the ability to invoke any shortcode handler exposed by core, themes, or other installed plugins. Impact varies by site composition but commonly includes information disclosure and abuse of privileged shortcode handlers.

Root Cause

The root cause is improper input validation in the plugin's AJAX action before invoking do_shortcode. The handler treats untrusted request input as a trusted shortcode expression, violating the principle that all external input must be validated against an allowlist before code-generating functions are called. The partial fix in 5.4.10.1 did not fully constrain the input surface, so exploitation paths remained until 5.4.10.2.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the plugin's AJAX endpoint with a crafted parameter containing one or more shortcodes. The server executes those shortcodes in the context of the WordPress process and returns the rendered output to the attacker. See the WordPress plugin source code reference and the Wordfence vulnerability report for technical details.

Detection Methods for CVE-2024-11977

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=kk-star-ratings containing shortcode syntax such as [ and ] in request parameters
Unexpected AJAX responses returning HTML fragments that match registered shortcode output rather than rating data
Access log entries from unauthenticated sources hitting the kk-star-ratings AJAX action at high frequency

Detection Strategies

Inspect WordPress access logs for requests to admin-ajax.php where the action parameter equals kk-star-ratings and request bodies contain URL-encoded %5B or %5D characters indicating shortcode brackets
Deploy web application firewall (WAF) rules that block shortcode patterns in parameters bound to the vulnerable AJAX action
Audit the installed plugin version against the patched release 5.4.10.2 across all WordPress hosts

Monitoring Recommendations

Alert on outbound HTTP requests originating from the WordPress server immediately after suspicious kk-star-ratings AJAX calls, which may indicate abuse of shortcodes that perform server-side fetches
Monitor for new or modified PHP files in the wp-content directory following exploitation attempts
Track anomalous spikes in admin-ajax.php traffic from a single source IP

How to Mitigate CVE-2024-11977

Immediate Actions Required

Update the kk Star Ratings plugin to version 5.4.10.2 or later on every WordPress instance
Verify that the plugin version is not 5.4.10.1, since that release only partially fixed the issue
Review WordPress access logs for prior exploitation attempts against the kk-star-ratings AJAX action

Patch Information

The vendor fully patched CVE-2024-11977 in kk Star Ratings version 5.4.10.2. Version 5.4.10.1 provided only a partial fix and remains exploitable. Refer to the Wordfence vulnerability report for vendor advisory details.

Workarounds

Deactivate and remove the kk Star Ratings plugin until the site can be updated to 5.4.10.2
Add WAF rules that reject requests to admin-ajax.php with action=kk-star-ratings when the body contains [ or ] characters
Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible

bash

# Example WAF rule (ModSecurity) to block shortcode payloads on the vulnerable action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1011977,msg:'Block CVE-2024-11977 shortcode injection'"
  SecRule ARGS:action "@streq kk-star-ratings" "chain"
  SecRule ARGS "@rx \[[a-zA-Z0-9_\-]+" "t:none,t:urlDecodeUni"