CVE-2024-13797: Presslayouts Pressmart RCE Vulnerability

CVE-2024-13797 Overview

The PressMart - Modern Elementor WooCommerce WordPress Theme for WordPress contains a critical arbitrary shortcode execution vulnerability affecting all versions up to and including 1.2.16. The vulnerability stems from improper validation of user-supplied input before passing it to the do_shortcode function. This security flaw allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to complete site compromise.

Critical Impact

Unauthenticated attackers can execute arbitrary shortcodes on vulnerable WordPress installations, potentially enabling remote code execution, data theft, and full site compromise without any authentication.

Affected Products

• PressMart - Modern Elementor WooCommerce WordPress Theme versions up to and including 1.2.16
• WordPress installations running the vulnerable PressMart theme
• WooCommerce sites using PressMart for their storefront

Discovery Timeline

• 2025-02-18 - CVE-2024-13797 published to NVD
• 2025-02-21 - Last updated in NVD database

Technical Details for CVE-2024-13797

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The PressMart theme fails to properly validate user-controlled input before passing it to WordPress's do_shortcode() function. In WordPress, shortcodes are special tags that execute PHP code, and when attackers can control which shortcodes are executed, they gain significant control over the WordPress installation.

The attack can be performed over the network without any authentication requirements or user interaction, making it trivially exploitable. Successful exploitation can result in complete compromise of the affected WordPress site, including unauthorized access to sensitive data, modification of site content, and potential execution of arbitrary code on the underlying server.

Root Cause

The root cause of this vulnerability is insufficient input validation in the PressMart theme's shortcode handling mechanism. The theme exposes an action endpoint that accepts user input and directly passes it to WordPress's do_shortcode() function without proper sanitization or validation. This allows attackers to inject malicious shortcode tags that the WordPress core will then execute with full privileges.

WordPress shortcodes can be extremely powerful, with many plugins registering shortcodes that perform privileged operations. By exploiting this vulnerability, attackers can leverage existing shortcodes from WordPress core, WooCommerce, or other installed plugins to perform unauthorized actions.

Attack Vector

The vulnerability is exploitable remotely over the network. An attacker can craft malicious HTTP requests targeting the vulnerable action endpoint in the PressMart theme. Since no authentication is required, any external attacker can exploit this vulnerability by sending specially crafted requests containing arbitrary shortcode payloads.

The attack flow involves identifying the vulnerable endpoint exposed by the PressMart theme, then crafting a request that includes a malicious shortcode string. When the vulnerable code processes this request without proper validation, it passes the attacker-controlled shortcode to do_shortcode(), which then executes the shortcode's associated PHP code. Depending on the shortcodes available on the target system, attackers may be able to read sensitive files, modify database content, create administrative accounts, or achieve remote code execution.

Detection Methods for CVE-2024-13797

Indicators of Compromise

• Unexpected HTTP requests to PressMart theme AJAX endpoints containing shortcode syntax (e.g., [shortcode] patterns in request parameters)
• Unusual activity in WordPress access logs showing repeated requests with encoded bracket characters or shortcode-like payloads
• Creation of unauthorized administrator accounts or unexpected user registrations
• Modifications to WordPress options, posts, or files that cannot be attributed to legitimate administrative activity
• Evidence of shortcode execution in error logs or debugging output

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing shortcode injection patterns
• Monitor WordPress activity logs for signs of unauthorized shortcode execution or unexpected administrative actions
• Deploy endpoint detection solutions like SentinelOne to identify post-exploitation activity on the web server
• Review server access logs for suspicious patterns targeting theme-specific endpoints
• Implement integrity monitoring on critical WordPress files to detect unauthorized modifications

Monitoring Recommendations

• Enable comprehensive logging for WordPress AJAX requests and theme-specific actions
• Configure alerting for failed authentication attempts followed by successful administrative actions
• Monitor for new user account creation, especially accounts with administrator privileges
• Implement file integrity monitoring for WordPress core files, themes, and plugin directories
• Review database changes regularly for signs of unauthorized content modification

How to Mitigate CVE-2024-13797

Immediate Actions Required

• Update the PressMart theme to a version newer than 1.2.16 immediately if a patched version is available
• If no patch is available, consider temporarily deactivating the PressMart theme and switching to a secure alternative
• Review WordPress user accounts for unauthorized administrators and remove any suspicious accounts
• Audit recent site changes for signs of compromise or unauthorized modifications
• Implement a Web Application Firewall with rules to block shortcode injection attempts

Patch Information

Users should check ThemeForest for updated versions of the PressMart theme that address this vulnerability. The Wordfence Vulnerability Report provides additional details and tracking for this security issue. Contact PresLayouts directly if no patched version is currently available.

Workarounds

• Restrict access to WordPress admin-ajax.php endpoints using server-level access controls where feasible
• Deploy a WAF solution such as Wordfence, Sucuri, or Cloudflare with rules configured to detect and block shortcode injection patterns
• Implement IP-based access restrictions to limit who can reach WordPress AJAX endpoints if your site does not require public AJAX functionality
• Consider running the WordPress installation in a containerized or sandboxed environment to limit the impact of potential exploitation
• Enable WordPress security hardening measures and minimize the number of installed plugins to reduce the attack surface from registered shortcodes

# Apache .htaccess example to restrict admin-ajax.php access
# Note: This may break legitimate functionality - test thoroughly
<Files admin-ajax.php>
    Order deny,allow
    Deny from all
    # Allow specific trusted IPs if needed
    # Allow from 192.168.1.0/24
</Files>