CVE-2024-8623 Overview
CVE-2024-8623 affects the MDTF – Meta Data and Taxonomies Filter plugin for WordPress in all versions up to and including 1.3.3.3. The plugin allows users to execute an action that does not properly validate a value before passing it to do_shortcode. Unauthenticated attackers can execute arbitrary shortcodes registered on the target site through this flaw. The vulnerability is classified as [CWE-94] Improper Control of Generation of Code (Code Injection).
Critical Impact
Unauthenticated remote attackers can trigger arbitrary shortcode execution on affected WordPress sites, leading to information disclosure, content manipulation, or further compromise depending on the shortcodes available.
Affected Products
- Pluginus MDTF – Meta Data and Taxonomies Filter for WordPress (plugin slug wp-meta-data-filter-and-taxonomy-filter)
- All versions up to and including 1.3.3.3
- WordPress installations with the plugin active and publicly reachable
Discovery Timeline
- 2024-09-24 - CVE-2024-8623 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-8623
Vulnerability Analysis
The MDTF plugin exposes an action handler that accepts user-supplied input and forwards it to the WordPress do_shortcode() function without sufficient validation. The affected logic is located in classes/page.php around line 248, as referenced in the WordPress Plugin Code Review. Because the action is reachable without authentication, any visitor can submit crafted parameter values that the plugin interprets as shortcode markup. WordPress then expands those shortcodes server-side using the privileges of the executing request.
The severity reflects an attack with low complexity, no privileges, no user interaction, and limited impact across confidentiality, integrity, and availability. The realised impact depends on which shortcodes the target site exposes. Many WordPress shortcodes reveal post content, user data, or perform queries that an unauthenticated visitor should not control.
Root Cause
The root cause is missing input validation before invocation of do_shortcode. The plugin treats request-controlled data as trusted template markup. Code injection through do_shortcode is a recurring WordPress weakness when developers fail to allowlist permitted shortcode names or sanitize bracketed input.
Attack Vector
An attacker sends an unauthenticated HTTP request to the WordPress endpoint that triggers the vulnerable plugin action. The request includes a parameter containing arbitrary shortcode syntax such as [shortcode_name attr="value"]. The plugin passes this value into do_shortcode, and WordPress evaluates each registered shortcode handler. Outcomes depend on the shortcode handlers active on the site, including those provided by other plugins or themes.
No public proof-of-concept exploit is referenced in the advisory data, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-8623
Indicators of Compromise
- HTTP requests to WordPress endpoints containing URL-encoded shortcode markup such as %5B and %5D in parameter values handled by the MDTF plugin.
- Unexpected output from authenticated-only shortcodes appearing in responses to unauthenticated requests.
- Access log entries referencing MDTF plugin actions from IP addresses with no prior browsing activity on the site.
Detection Strategies
- Inspect web server access logs for admin-ajax.php or front-end requests carrying the MDTF action parameter combined with shortcode delimiters in user-controlled fields.
- Hunt for anomalous response sizes or content types returned by MDTF-related endpoints, which can indicate evaluated shortcode output.
- Correlate WordPress plugin inventory data with the affected version range <= 1.3.3.3 to identify exposed installations.
Monitoring Recommendations
- Enable verbose logging in any deployed Web Application Firewall (WAF) and create rules that flag [ and ] characters inside MDTF request parameters.
- Monitor file integrity for wp-content/plugins/wp-meta-data-filter-and-taxonomy-filter/ to detect tampering.
- Track outbound network connections initiated by PHP-FPM workers after MDTF endpoints are invoked.
How to Mitigate CVE-2024-8623
Immediate Actions Required
- Update the MDTF – Meta Data and Taxonomies Filter plugin to a version newer than 1.3.3.3 as soon as the vendor publishes a fix.
- Audit the WordPress site for installed shortcodes that could expose sensitive data or perform privileged operations.
- Block unauthenticated requests containing shortcode markup at the WAF or reverse proxy layer until patching is complete.
Patch Information
The vendor committed code changes to the plugin repository, referenced in the WordPress Plugin Change Log. Administrators should install the latest plugin release through the WordPress admin dashboard or via WP-CLI and verify the version after upgrade.
Workarounds
- Deactivate the MDTF plugin if the patched version is not yet available or cannot be applied.
- Restrict access to MDTF endpoints by IP allowlist for sites where the filter UI is only used by trusted users.
- Add WAF rules that reject requests targeting MDTF actions with bracket characters in their payloads.
# Update the plugin via WP-CLI on the affected host
wp plugin update wp-meta-data-filter-and-taxonomy-filter
wp plugin get wp-meta-data-filter-and-taxonomy-filter --field=version
# Temporary workaround: deactivate until patched
wp plugin deactivate wp-meta-data-filter-and-taxonomy-filter
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
