CVE-2024-13792: Exthemes WooCommerce Food RCE Vulnerability

CVE-2024-13792 Overview

CVE-2024-13792 is a critical arbitrary shortcode execution vulnerability affecting the WooCommerce Food - Restaurant Menu & Food ordering plugin for WordPress. The vulnerability exists in all versions up to and including 3.3.2, allowing unauthenticated attackers to execute arbitrary shortcodes due to improper input validation before processing the do_shortcode function.

This code injection vulnerability (CWE-94) enables remote attackers to exploit WordPress shortcode functionality without authentication, potentially leading to complete site compromise depending on other installed plugins and their shortcode capabilities.

Critical Impact

Unauthenticated remote attackers can execute arbitrary WordPress shortcodes, potentially leading to sensitive data exposure, unauthorized actions, or further exploitation of shortcode-dependent plugins.

Affected Products

• WooCommerce Food - Restaurant Menu & Food ordering plugin for WordPress versions ≤ 3.3.2
• WordPress installations with the exthemes WooCommerce Food plugin installed
• E-commerce websites using the plugin for restaurant menu and food ordering functionality

Discovery Timeline

• 2025-02-20 - CVE-2024-13792 published to NVD
• 2025-09-10 - Last updated in NVD database

Technical Details for CVE-2024-13792

Vulnerability Analysis

This vulnerability is classified as Code Injection (CWE-94) and affects the WooCommerce Food plugin's handling of user-controlled input. The root cause lies in the plugin's failure to properly validate user input before passing it to WordPress's do_shortcode() function, which processes shortcode tags embedded within content.

WordPress shortcodes are macros that execute specific functions when parsed. When an application fails to sanitize input before calling do_shortcode(), attackers can inject arbitrary shortcode syntax that will be executed server-side. The impact varies based on available shortcodes from other plugins, but commonly allows information disclosure, privilege escalation, or execution of sensitive administrative functions.

The network-accessible nature of this vulnerability, combined with no authentication requirements and no user interaction needed, makes it highly exploitable in automated attack scenarios.

Root Cause

The vulnerability stems from inadequate input validation within the WooCommerce Food plugin. The affected code path accepts user-provided data and passes it directly to the do_shortcode() WordPress core function without proper sanitization or allowlist filtering. This design flaw allows attackers to craft malicious requests containing shortcode syntax that the plugin will unwittingly execute.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to a WordPress site running the vulnerable plugin. The malicious request would include shortcode syntax in a parameter that the plugin processes without validation.

When the plugin receives this input and calls do_shortcode(), WordPress parses and executes any valid shortcodes contained within the attacker-controlled string. This could invoke shortcodes from other plugins, potentially triggering file operations, database queries, email sending, or other sensitive actions depending on the target site's plugin ecosystem.

The vulnerability mechanism involves improper validation before running do_shortcode(). Attackers can craft requests with embedded shortcode syntax such as [shortcode_name attribute="value"] that bypasses any existing validation. When processed, these shortcodes execute with the privileges of the web server, enabling various attack scenarios. For detailed technical analysis, refer to the Wordfence vulnerability report.

Detection Methods for CVE-2024-13792

Indicators of Compromise

• Unusual HTTP requests containing WordPress shortcode syntax patterns (e.g., [, ] brackets with alphanumeric content) in request parameters
• Access logs showing repeated requests to WooCommerce Food plugin endpoints with encoded or obfuscated shortcode payloads
• Unexpected execution of shortcodes from other installed plugins, particularly administrative or file-operation shortcodes
• Error logs indicating failed shortcode parsing or unexpected shortcode callbacks

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing shortcode bracket syntax in user-controllable parameters
• Monitor WordPress error logs for anomalous shortcode execution events or failed shortcode parsing attempts
• Deploy file integrity monitoring on WordPress installations to detect unauthorized changes resulting from shortcode exploitation
• Use security plugins with real-time threat detection capabilities to identify exploitation attempts

Monitoring Recommendations

• Enable detailed access logging and review for suspicious patterns targeting WooCommerce Food plugin endpoints
• Configure alerts for requests containing common WordPress shortcode patterns in POST data or query strings
• Monitor for unexpected database queries or file system access originating from shortcode handlers
• Review plugin audit logs for unauthorized shortcode registrations or modifications

How to Mitigate CVE-2024-13792

Immediate Actions Required

• Update the WooCommerce Food plugin to a version newer than 3.3.2 that includes the security patch
• If an immediate update is not possible, temporarily disable the WooCommerce Food plugin until patching is completed
• Audit WordPress installations to identify sites running vulnerable versions of the plugin
• Review server logs for indicators of past exploitation attempts

Patch Information

The vulnerability affects WooCommerce Food - Restaurant Menu & Food ordering plugin versions up to and including 3.3.2. Administrators should update to the latest available version from the Codecanyon marketplace which addresses this security issue. Always verify the plugin version in your WordPress dashboard under Plugins and confirm the update resolves CVE-2024-13792.

Workarounds

• Disable the WooCommerce Food plugin temporarily if the update cannot be applied immediately
• Implement WAF rules to block requests containing shortcode bracket syntax ([ and ]) in user-controllable input fields targeting the plugin
• Restrict access to the WordPress site during the mitigation window if critical business operations permit
• Review and disable unnecessary shortcodes from other plugins to minimize the attack surface if exploitation occurs

# Configuration example - WAF rule to block shortcode injection attempts
# ModSecurity rule example
SecRule ARGS "@rx \[[\w\s_-]+(\s+[\w_-]+=['\"]?[^'\"]*['\"]?)*\s*\]" \
    "id:1001,phase:2,deny,status:403,msg:'Potential WordPress shortcode injection blocked'"