CVE-2024-10959 is a code injection vulnerability classified under CWE-94 affecting the WordPress plugin 'Active Products Tables for WooCommerce. Use constructor to create tables' developed by realmag777. The flaw exists in all versions up to 1.0.6.5 and arises because the plugin improperly validates input passed to the do_shortcode function via the woot_get_smth AJAX action. This improper validation allows unauthenticated attackers to execute arbitrary shortcodes remotely without any user interaction or authentication. Shortcodes in WordPress can execute PHP code or trigger other plugin functionality, so arbitrary shortcode execution can lead to remote code execution, data leakage, site defacement, or denial of service. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). The scope is unchanged (S:U), but the impact affects confidentiality, integrity, and availability to a low to moderate degree (C:L/I:L/A:L). Although no public exploits are currently known, the ease of exploitation and the widespread use of WooCommerce and WordPress make this a significant threat. The vulnerability was published on December 10, 2024, and has a CVSS 3.1 score of 7.3, reflecting its high severity. The lack of available patches at the time of disclosure increases the urgency for mitigation.

This vulnerability enables unauthenticated remote attackers to execute arbitrary shortcodes on affected WordPress sites running the vulnerable plugin, potentially leading to remote code execution or unauthorized actions. The impact includes possible data exposure, modification or deletion of content, site defacement, and disruption of e-commerce operations. Since WooCommerce is widely used for online stores, exploitation could result in financial losses, reputational damage, and loss of customer trust. The ability to execute code without authentication increases the risk of automated attacks and mass exploitation attempts. Organizations relying on this plugin for product display and sales are particularly vulnerable, and compromised sites could be used as a foothold for further attacks within corporate networks or to distribute malware to visitors.

1. Immediately update the 'Active Products Tables for WooCommerce. Use constructor to create tables' plugin to a patched version once available from the vendor. 2. Until a patch is released, disable or remove the plugin to eliminate the attack surface. 3. Implement Web Application Firewall (WAF) rules to block or monitor requests to the woot_get_smth AJAX action, especially those containing suspicious shortcode parameters. 4. Restrict access to the AJAX endpoint by IP whitelisting or requiring authentication where feasible. 5. Conduct a thorough audit of WordPress installations to identify and inventory the use of this plugin. 6. Monitor logs for unusual or repeated requests to the vulnerable AJAX action. 7. Educate site administrators on the risks of installing unverified plugins and the importance of timely updates. 8. Employ security plugins that can detect and block malicious shortcode execution attempts. 9. Regularly back up site data and configurations to enable quick recovery if exploitation occurs.