CVE-2024-13812: Anps Theme WordPress Plugin RCE Vulnerability

CVE-2024-13812 Overview

CVE-2024-13812 affects the Anps Theme plugin for WordPress in all versions up to and including 1.1.1. The plugin exposes an action handler that invokes do_shortcode on user-supplied input without proper validation. Unauthenticated attackers can send crafted requests to execute arbitrary WordPress shortcodes on affected sites. The issue is classified under CWE-94: Improper Control of Generation of Code. Depending on which shortcodes are registered by other installed plugins or themes, attackers can disclose information, enumerate content, or trigger unintended actions in the WordPress environment.

Critical Impact

Unauthenticated remote attackers can execute arbitrary shortcodes on vulnerable WordPress sites, enabling information disclosure and abuse of any registered shortcode handler.

Affected Products

• Anps Theme WordPress plugin, all versions through 1.1.1
• WordPress sites bundling the plugin as part of ANP Themes installations
• Any WordPress deployment where the vulnerable plugin remains active

Discovery Timeline

• 2025-04-26 - CVE-2024-13812 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13812

Vulnerability Analysis

The Anps Theme plugin registers a request handler that passes attacker-controlled input directly to WordPress's do_shortcode function. do_shortcode parses and executes any registered shortcode found in the supplied string. Because the plugin does not validate or sanitize the value before invocation, any client can trigger shortcode execution.

The impact scope is defined by the shortcodes registered on the target site. Common examples include content retrieval, user enumeration, email sending, and administrative helper shortcodes provided by other plugins. Attackers can chain these to disclose data or invoke unintended functionality.

Authentication is not required, and the endpoint is reachable over the network with low attack complexity. See the Wordfence Vulnerability Report for indexing details.

Root Cause

The root cause is missing input validation before invoking do_shortcode on request-scoped data. The plugin trusts the incoming value and hands it to the shortcode parser without allowlisting shortcode names, restricting call sites, or requiring capability checks.

Attack Vector

Exploitation requires only an HTTP request to the vulnerable action endpoint exposed by the plugin. An unauthenticated attacker submits a parameter containing one or more WordPress shortcodes. The plugin invokes do_shortcode on the parameter, and any shortcode registered in the site's runtime executes with the plugin's context. No verified public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2024-13812

Indicators of Compromise

• HTTP POST or GET requests to Anps Theme plugin AJAX or action endpoints containing shortcode syntax such as [ and ] in parameters
• Unexpected shortcode output rendered in HTTP responses from anonymous requests
• Log entries showing repeated calls to plugin action handlers from a single IP or user agent

Detection Strategies

• Inspect WordPress access logs for requests to Anps Theme plugin endpoints that include bracket-delimited shortcode payloads in query strings or POST bodies
• Alert on unauthenticated requests that trigger shortcode-generated output, particularly those referencing user, content, or administrative shortcodes
• Correlate requests to the vulnerable endpoint with subsequent anomalous data retrieval or outbound email activity

Monitoring Recommendations

• Enable verbose logging on the WordPress application and web application firewall for the plugin's action routes
• Track the list of registered shortcodes on each site and monitor for calls originating from unauthenticated sessions
• Review web server telemetry for high-volume enumeration attempts against admin-ajax.php or plugin-specific endpoints

How to Mitigate CVE-2024-13812

Immediate Actions Required

• Deactivate and remove the Anps Theme plugin if it is not required for site functionality
• Restrict access to WordPress action endpoints exposed by the plugin at the web application firewall or reverse proxy
• Audit installed plugins for high-impact shortcodes that could be abused if arbitrary shortcode execution occurs

Patch Information

No fixed version is identified in the advisory data. All versions through 1.1.1 remain vulnerable. Site operators should monitor the ANP Themes vendor site and the Wordfence Vulnerability Report for a patched release, and remove the plugin until a fix is available.

Workarounds

• Uninstall the plugin until a patched version is released by the vendor
• Deploy web application firewall rules that block shortcode syntax in parameters sent to Anps Theme plugin endpoints
• Unregister high-risk shortcodes from other plugins that are not required, reducing the impact of arbitrary shortcode execution

# Example WAF rule concept: block requests to plugin endpoints containing shortcode brackets
# ModSecurity-style pseudocode
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1013812,msg:'Block Anps Theme shortcode injection'"
  SecRule ARGS "@rx \[[a-zA-Z0-9_\-]+" "t:none"