CVE-2024-13797: Presslayouts Pressmart RCE Vulnerability

CVE-2024-13797 Overview

CVE-2024-13797 is a critical arbitrary shortcode execution vulnerability affecting the PressMart - Modern Elementor WooCommerce WordPress Theme. The flaw exists in all versions up to and including 1.2.16. The theme exposes an action that calls do_shortcode on user-supplied input without proper validation. Unauthenticated remote attackers can invoke arbitrary WordPress shortcodes, including any registered by other plugins or themes installed on the site. This vulnerability is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Unauthenticated attackers can execute arbitrary shortcodes remotely, enabling content disclosure, configuration manipulation, and chained exploitation through other plugin shortcodes.

Affected Products

Presslayouts PressMart WordPress Theme versions through 1.2.16
WordPress installations using PressMart with WooCommerce integration
Sites with additional plugins exposing privileged shortcodes

Discovery Timeline

2025-02-18 - CVE-2024-13797 published to the National Vulnerability Database
2025-02-21 - Last updated in NVD database

Technical Details for CVE-2024-13797

Vulnerability Analysis

The PressMart theme registers an action handler that accepts a parameter and passes it directly to the WordPress do_shortcode() function. The handler omits capability checks and nonce verification, leaving the endpoint reachable by unauthenticated visitors. WordPress shortcodes can render content, query the database, and trigger side effects depending on which plugins are active. Attackers abuse this by submitting any shortcode known to exist on the target installation.

The risk scales with the plugin ecosystem on each site. Shortcodes from membership, form, or file management plugins frequently expose protected data or perform privileged operations. By chaining PressMart's unauthenticated entry point with such shortcodes, attackers reach functionality intended for administrators. Refer to the Wordfence Vulnerability Analysis for the underlying advisory.

Root Cause

The root cause is missing input validation before invoking do_shortcode. The theme treats attacker-controlled strings as trusted shortcode markup. There is no allowlist restricting which shortcode tags can be processed and no authentication gate on the AJAX or admin-post action.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a crafted HTTP request to the vulnerable PressMart action endpoint with a shortcode parameter containing the desired tag. No user interaction, account, or privileges are required. The server executes the shortcode in the context of the WordPress runtime and returns the rendered output.

No verified public proof-of-concept code is currently linked to this CVE. Technical specifics of the affected handler are described in the Wordfence advisory referenced above.

Detection Methods for CVE-2024-13797

Indicators of Compromise

HTTP requests to PressMart AJAX or admin-post endpoints containing shortcode markup such as [...] in POST or GET parameters
Unauthenticated requests returning rendered shortcode output from theme-specific action handlers
Unexpected outbound connections or content modifications correlating with requests to PressMart action URLs

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php or admin-post.php referencing PressMart actions with shortcode-like payloads
Deploy WAF rules that flag unauthenticated POST bodies containing WordPress shortcode syntax targeting theme endpoints
Audit installed plugins to enumerate registered shortcodes and assess which would yield sensitive data if invoked anonymously

Monitoring Recommendations

Alert on file integrity changes within wp-content/themes/pressmart/ and wp-content/uploads/
Monitor for new or modified WordPress administrator accounts following suspicious requests to PressMart endpoints
Track database query volume spikes correlated with anonymous requests, which may indicate shortcode-driven data extraction

How to Mitigate CVE-2024-13797

Immediate Actions Required

Update the PressMart theme to a version later than 1.2.16 once the vendor publishes a fix
Place the WordPress site behind a Web Application Firewall with rules blocking shortcode payloads in unauthenticated requests
Audit active plugins and disable any whose shortcodes expose sensitive data or perform privileged actions

Patch Information

At the time of NVD publication, all PressMart versions through 1.2.16 are affected. Site operators should monitor the ThemeForest PressMart listing and the Wordfence advisory for patch availability and apply updates immediately upon release.

Workarounds

Restrict access to PressMart AJAX action endpoints via web server rules until a patch is available
Temporarily switch to an alternate theme if the site exposes high-value plugin shortcodes that cannot be disabled
Use a security plugin to require authentication or nonces on theme AJAX endpoints where feasible

bash

# Example nginx rule to block unauthenticated shortcode payloads to admin-ajax.php
location = /wp-admin/admin-ajax.php {
    if ($request_method = POST) {
        if ($request_body ~* "\[[a-z0-9_\-]+[^]]*\]") {
            return 403;
        }
    }
}