CVE-2024-13900: Head, Footer, Post Injections RCE Vulnerability

CVE-2024-13900 Overview

CVE-2024-13900 is a PHP Code Injection vulnerability in the Head, Footer and Post Injections plugin for WordPress. The flaw affects all versions up to and including 3.3.0. Authenticated attackers with Administrator-level access can inject arbitrary PHP code in WordPress multisite environments. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code.

The plugin, developed by Satollo, is used to inject scripts and content into WordPress site headers, footers, and posts. In multisite deployments, site administrators traditionally have restricted privileges compared to super administrators, and this plugin bypasses that separation of duties.

Critical Impact
Administrator-level users on WordPress multisite installations can execute arbitrary PHP code on the underlying server, leading to full site compromise across the network.

Affected Products

Satollo Head, Footer and Post Injections plugin for WordPress
All versions up to and including 3.3.0
WordPress multisite environments running the vulnerable plugin

Discovery Timeline

2025-02-21 - CVE-2024-13900 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13900

Vulnerability Analysis

The Head, Footer and Post Injections plugin allows administrators to insert custom code snippets into WordPress pages. The plugin does not sufficiently restrict which input fields can contain executable PHP. When processed, these inputs are evaluated as PHP code on the server.

In standard single-site WordPress installations, administrators can already install plugins and edit themes, so PHP execution is expected. Multisite installations, however, distinguish between super administrators, who manage the entire network, and site administrators, whose privileges are intentionally reduced. This vulnerability allows a site administrator to break that boundary and reach code execution parity with a super administrator.

Successful exploitation results in complete compromise of confidentiality, integrity, and availability across all sites in the network sharing the WordPress installation.

Root Cause

The root cause is improper control of generation of code ([CWE-94]). The plugin accepts input from users with the manage_options or equivalent site-level capability and passes it into a PHP execution context without validating that the caller holds the higher unfiltered_html or super administrator capability required in multisite mode.

Attack Vector

The attack is network-based and requires authentication with Administrator privileges on a subsite of a WordPress multisite network. No user interaction is required. An attacker who has already obtained or been assigned site administrator credentials submits a payload through the plugin's injection settings interface. On the next page render that triggers the injection point, the payload executes as PHP within the web server process, giving the attacker code execution on the host and read/write access to the entire network's database and files.

No verified public exploit code was available at the time of writing. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-13900

Indicators of Compromise

Unexpected PHP code, eval() calls, or base64-encoded payloads stored in the plugin's head, footer, or post injection option fields within the wp_options or wp_sitemeta tables.
New or modified files under wp-content/uploads/ or the active theme directory that were not deployed by legitimate release processes.
Outbound network connections from the web server to unknown hosts shortly after administrator logins to subsites.

Detection Strategies

Audit the plugin's stored configuration values across all sites in the multisite network for content that looks like PHP rather than HTML or JavaScript.
Compare installed plugin version against the fixed release published in the WordPress plugin changeset 3244016.
Review WordPress audit logs for changes to head, footer, or post injection settings correlated with newly created or recently escalated administrator accounts.

Monitoring Recommendations

Monitor the web server process for unusual child processes such as sh, bash, curl, or wget spawned from PHP-FPM or Apache workers.
Alert on modifications to WordPress core files, plugin files, and wp-config.php outside of scheduled maintenance windows.
Track authentication events for multisite administrator accounts, especially logins from new geographies or ASN ranges.

How to Mitigate CVE-2024-13900

Immediate Actions Required

Update the Head, Footer and Post Injections plugin to a version later than 3.3.0 that incorporates the fix from changeset 3244016.
Review all site-level administrator accounts across the multisite network and remove any that are not strictly required.
Inspect existing plugin configuration values in every subsite for injected PHP and remove suspicious content before applying the patch.

Patch Information

The vendor addressed the vulnerability in the WordPress plugin repository via changeset 3244016. Administrators should update to the patched release through the WordPress admin dashboard or by replacing the plugin files from the official plugin repository. Refer to the Wordfence advisory for confirmation of the fixed version.

Workarounds

Deactivate and remove the Head, Footer and Post Injections plugin from multisite networks until it can be updated.
Restrict PHP execution in WordPress by defining DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS in wp-config.php where operationally acceptable.
Limit subsite administrator assignments to trusted personnel and require multi-factor authentication for all administrator logins.

bash

# Configuration example: harden WordPress multisite wp-config.php
define( 'DISALLOW_FILE_EDIT', true );
define( 'DISALLOW_FILE_MODS', true );
define( 'DISALLOW_UNFILTERED_HTML', true );