CVE-2024-8541: Discount Rules For WooCommerce XSS Vulnerability

CVE-2024-8541 Overview

CVE-2024-8541 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Discount Rules for WooCommerce WordPress plugin developed by Flycart. The flaw affects all versions of the plugin up to and including 2.6.5. The root cause is the use of add_query_arg without proper URL escaping in the plugin's admin review notice. Unauthenticated attackers can inject arbitrary JavaScript that executes in an administrator's browser if the administrator is tricked into clicking a crafted link. Exploitation requires the 'Leave a Review' admin notice to be present, which appears after 100 orders are processed and disappears once dismissed.

Critical Impact
Successful exploitation allows execution of attacker-controlled scripts in an authenticated administrator session, enabling session theft, privilege abuse, and site takeover actions.

Affected Products

Flycart Discount Rules for WooCommerce plugin for WordPress
All versions up to and including 2.6.5
WooCommerce sites where the 'Leave a Review' admin notice is active (after 100 orders)

Discovery Timeline

2024-10-16 - CVE-2024-8541 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8541

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting issue [CWE-79] in the plugin's administrative review notice component. The plugin passes the current request URL to WordPress's add_query_arg function without sanitizing or escaping the resulting output before rendering it in the admin interface. When an administrator clicks a maliciously crafted URL pointing to their own WordPress site, the injected payload reflects into the response and executes in the administrator's browser context.

Because the payload runs with the administrator's privileges, an attacker can perform any action available to that user. Common outcomes include creating new administrator accounts, injecting persistent backdoors into themes or plugins, exfiltrating session tokens, and pivoting to the underlying WooCommerce order and customer data.

Exploitation is constrained by two conditions. First, the 'Leave a Review' notice must be rendered, which only occurs after the store has processed 100 orders. Second, the notice must not have been dismissed by any administrator. These constraints reduce, but do not eliminate, the exploitable population.

Root Cause

The defect resides in v2/App/Views/Admin/review-notice.php. The template invokes add_query_arg on the current request URI and echoes the returned value without applying esc_url or equivalent output encoding. Attacker-controlled query parameters are preserved verbatim and reflected into HTML attributes, breaking out of the intended context.

Attack Vector

The attack requires user interaction. An attacker crafts a URL targeting the victim's WordPress admin area with a malicious query string designed to break out of the reflected attribute. The attacker delivers the link through phishing, forum posts, or comments. When an authenticated administrator visits the link, the payload executes in the admin origin.

The vulnerable code path renders the crafted parameters directly into the review notice markup. See the WordPress Plugin Review Notice source for the affected template and the WordPress Changeset #3149013 for the applied fix.

Detection Methods for CVE-2024-8541

Indicators of Compromise

Web server access logs containing requests to /wp-admin/ URLs with query parameters holding HTML tags, javascript: URIs, or encoded <script> payloads.
Unexpected creation of new administrator accounts or modifications to user roles shortly after admin sessions.
New or modified plugin and theme files with obfuscated JavaScript or PHP shortly after suspicious admin activity.
Outbound requests from the WordPress host to unfamiliar domains initiated from admin sessions.

Detection Strategies

Alert on inbound HTTP requests to wp-admin endpoints containing script tags, event handlers such as onerror= or onload=, or URL-encoded variants in query strings.
Compare installed plugin versions against 2.6.5 and flag any host running an affected build.
Correlate administrator login events with subsequent privileged actions (user creation, plugin installation, file edits) initiated from the same session.

Monitoring Recommendations

Enable and centralize WordPress audit logs to capture administrator actions and plugin changes.
Deploy a web application firewall (WAF) with rules covering reflected XSS patterns against WordPress admin paths.
Track file integrity for wp-content/plugins, wp-content/themes, and core PHP files to detect post-exploitation tampering.

How to Mitigate CVE-2024-8541

Immediate Actions Required

Update the Discount Rules for WooCommerce plugin to a version later than 2.6.5 that includes the fix from changeset 3149013.
Audit administrator accounts, sessions, and recently modified plugin or theme files for signs of prior exploitation.
Force password rotation and session invalidation for all WordPress administrator accounts.
Instruct administrators to avoid clicking untrusted links that target the site's wp-admin interface.

Patch Information

Flycart addressed the issue in the plugin release referenced by WordPress Changeset #3149013. The fix applies proper output escaping to the URL rendered by the review notice. Additional details are available in the Wordfence Vulnerability Report.

Workarounds

Dismiss the 'Leave a Review' admin notice on all affected sites to remove the vulnerable rendering path.
Temporarily deactivate the Discount Rules for WooCommerce plugin until it can be updated.
Deploy WAF rules that block reflected XSS payloads targeting /wp-admin/ request parameters.
Restrict administrator access to trusted IP ranges through server or WAF controls.

bash

# Example WAF rule concept (ModSecurity-style) to block script payloads in wp-admin query strings
SecRule REQUEST_URI "@beginsWith /wp-admin/" \
  "chain,phase:2,deny,status:403,id:1008541,msg:'Reflected XSS attempt against wp-admin'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"