CVE-2024-8479: Simple Spoiler Plugin RCE Vulnerability

CVE-2024-8479 Overview

CVE-2024-8479 affects the Simple Spoiler plugin for WordPress in versions 1.2 through 1.3. The plugin registers add_filter('comment_text', 'do_shortcode');, which causes WordPress to execute any shortcode submitted inside a comment. Unauthenticated attackers can submit comments containing arbitrary shortcodes that the plugin then executes against the site context. The flaw is categorized as Code Injection [CWE-94] and stems from applying do_shortcode to untrusted user input.

Critical Impact
Unauthenticated remote attackers can execute arbitrary shortcodes through the WordPress comment system, abusing any shortcode registered by other installed plugins or themes.

Affected Products

Webliberty Simple Spoiler plugin for WordPress, version 1.2
Webliberty Simple Spoiler plugin for WordPress, version 1.3
WordPress sites with the plugin active and comments enabled

Discovery Timeline

2024-09-14 - CVE-2024-8479 published to NVD
2024-09-27 - Last updated in NVD database

Technical Details for CVE-2024-8479

Vulnerability Analysis

The Simple Spoiler plugin extends WordPress comment rendering by attaching do_shortcode to the comment_text filter. WordPress applies this filter to every comment body before display, so the plugin causes the shortcode parser to execute on attacker-controlled comment content. Any shortcode registered on the site, whether from the active theme, the core install, or any other plugin, becomes reachable from an anonymous commenter.

The impact depends on which shortcodes exist on the target site. Attackers can invoke shortcodes that disclose data, list users, include arbitrary files, send email, or alter content. The vulnerability is network-reachable, requires no authentication, and needs no user interaction.

Root Cause

The root cause is unsafe trust in untrusted input. The plugin treats comment bodies, which can be submitted by unauthenticated visitors when comments are open, as trusted shortcode input. WordPress core deliberately omits do_shortcode from default comment rendering for this reason. By adding the filter globally, the plugin removes that safety boundary and exposes every site shortcode to the public comment surface.

Attack Vector

An attacker submits a comment on any post that allows comments. The comment body contains one or more shortcodes targeting functionality registered by other plugins or the theme. When the comment is rendered, either after auto-approval or after moderation, WordPress evaluates the shortcodes server-side and includes the output in the response. The vulnerable filter registration is documented in the Simple Spoiler plugin source code.

No exploit code is described in this advisory. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-8479

Indicators of Compromise

Comment records in wp_comments containing shortcode syntax such as [shortcode_name ...] from unauthenticated submitters.
Unexpected output rendered inside comment bodies that references plugin or theme functionality.
Outbound requests, file reads, or user enumeration originating from the PHP worker immediately after a comment is posted or approved.

Detection Strategies

Audit installed WordPress plugins for Simple Spoiler version 1.2 or 1.3 using the plugin file header in wp-content/plugins/simple-spoiler/simple-spoiler.php.
Search the comments table for entries containing [ and ] patterns matching known shortcode names registered on the site.
Review web server access logs for POST requests to wp-comments-post.php that include shortcode markers in the request body.

Monitoring Recommendations

Alert on anomalous PHP behavior, such as file_get_contents, wp_mail, or database read spikes triggered during comment rendering.
Track changes to wp-content/plugins/simple-spoiler/ and flag the presence of add_filter('comment_text', 'do_shortcode').
Monitor for new or modified administrative users created in proximity to comment submissions.

How to Mitigate CVE-2024-8479

Immediate Actions Required

Deactivate the Simple Spoiler plugin on every WordPress site running version 1.2 or 1.3 until a fixed release is installed.
Remove or moderate pending comments submitted while the plugin was active to prevent delayed shortcode execution on approval.
Inventory other installed plugins and themes to identify shortcodes that could amplify impact if invoked from a comment.

Patch Information

The vendor committed changes to the plugin trunk in the WordPress Plugin Changeset. Update Simple Spoiler to a version later than 1.3 that no longer registers do_shortcode against the comment_text filter. Verify the fix by inspecting simple-spoiler.php and confirming the add_filter('comment_text', 'do_shortcode') call has been removed or scoped.

Workarounds

Disable comments site-wide or on posts where the plugin output is not required.
Add a must-use plugin that calls remove_filter('comment_text', 'do_shortcode') after Simple Spoiler loads to neutralize the unsafe filter.
Restrict comment submission to authenticated users and enforce moderation before any comment is published.

bash

# Configuration example: mu-plugin to strip the unsafe filter
# Save as wp-content/mu-plugins/disable-spoiler-shortcodes.php
<?php
add_action('init', function () {
    remove_filter('comment_text', 'do_shortcode');
}, 999);