CVE-2024-9349: Auto Amazon Links XSS Vulnerability

CVE-2024-9349 Overview

CVE-2024-9349 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Auto Amazon Links – Amazon Associates Affiliate Plugin for WordPress. The plugin uses add_query_arg without proper escaping of the URL, affecting all versions up to and including 5.4.2. Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser after the victim clicks a crafted link. The vulnerability is tracked under CWE-79 and impacts WordPress sites running the affected plugin.

Critical Impact
Attackers can execute arbitrary scripts in an administrator's browser session, enabling session theft, administrative action abuse, and further site compromise.

Affected Products

Michaeluno Auto Amazon Links plugin for WordPress, all versions up to and including 5.4.2
WordPress installations with the affected plugin activated
Administrative users of impacted WordPress sites

Discovery Timeline

2024-10-04 - CVE-2024-9349 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9349

Vulnerability Analysis

The vulnerability resides in the plugin's HTTP request admin page component, specifically at include/core/main/admin/report/http_request/AmazonAutoLinks_AdminPage_Tab_HTTPRequest.php. The plugin invokes WordPress's add_query_arg function with untrusted request data and reflects the resulting URL into the rendered page without escaping. Because add_query_arg preserves attacker-controlled input from the current request URI, an attacker can craft a URL that injects HTML or JavaScript into the output. The injected payload executes in the context of any user who visits the crafted link, including authenticated administrators.

Root Cause

The root cause is missing output escaping around a URL constructed with add_query_arg. The plugin trusts request parameters that flow into the query string builder and emits the value into HTML attributes without esc_url or esc_attr. This pattern is a well-known WordPress security anti-pattern documented by the WordPress security team.

Attack Vector

Exploitation requires user interaction. The attacker crafts a malicious URL pointing to the affected admin page with a payload embedded in a query parameter. When a logged-in WordPress user clicks the link, the browser renders the reflected payload and executes the injected script under the site's origin. Successful exploitation enables session cookie theft, forced administrative actions via forged requests, and delivery of secondary payloads. See the WordPress Plugin Source Code for the vulnerable code path and the Wordfence Vulnerability Analysis for further technical detail.

Detection Methods for CVE-2024-9349

Indicators of Compromise

Access log entries containing script tags, JavaScript event handlers, or URL-encoded payloads in query strings targeting the plugin's admin pages
Unexpected outbound requests from administrator browsers to attacker-controlled domains following clicks on external links
New or modified WordPress administrator accounts created shortly after suspicious admin page requests

Detection Strategies

Inventory WordPress installations and identify sites running Auto Amazon Links at version 5.4.2 or earlier
Inspect web server access logs for requests to the plugin's HTTP request admin tab containing suspicious characters such as <, >, ", javascript:, or onerror=
Deploy a Web Application Firewall (WAF) rule that blocks reflected XSS patterns in query parameters directed at /wp-admin/ paths

Monitoring Recommendations

Alert on anomalous administrator session behavior, including unexpected privilege changes and plugin installations
Monitor referrer headers on WordPress admin requests for external origins that may indicate phishing-driven exploitation
Correlate email gateway telemetry with WordPress admin access logs to identify users targeted by malicious links

How to Mitigate CVE-2024-9349

Immediate Actions Required

Update Auto Amazon Links to a version later than 5.4.2 as soon as the patched release is available from the plugin repository
Deactivate the plugin if a fixed version is not yet installed and the site cannot be shielded by a WAF
Instruct WordPress administrators to avoid clicking untrusted links while authenticated to the site

Patch Information

The plugin vendor addressed the flaw in a changeset published to the WordPress plugin repository. Refer to the WordPress Plugin Changeset for the exact code changes and to the Wordfence Vulnerability Analysis for confirmation of the fixed version.

Workarounds

Restrict access to /wp-admin/ paths by source IP address using web server or reverse proxy rules
Enforce a strict Content Security Policy (CSP) on the WordPress admin interface to block inline script execution
Require administrators to use separate browser profiles or dedicated browsers for WordPress administration to limit session exposure

bash

# Example nginx rule to block reflected XSS patterns targeting the vulnerable admin tab
location ~* /wp-admin/admin\.php {
    if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
}