WordPress Virtue Theme CVE-2024-16479/16478 Unauthenticated RCE via custom_css Parameter

CVE-2024-16479 / CVE-2024-16478: Virtue Theme Remote Code Execution Vulnerabilities Vulnerability Overview The WordPress Virtue theme (versions 4.1.1 and earlier) contains two critical vulnerabilities that allow unauthenticated attackers to execute arbitrary code on the target server by crafting malicious requests. CVE-2024-16479: Achieves remote code execution via the function within the parameter. CVE-2024-16478: Achieves remote code execution via the function within the parameter (similar to the former, but with a different trigger path). Both vulnerabilities stem from improper handling of the parameter, lacking sufficient filtering or escaping, which allows attackers to inject and execute arbitrary PHP code. Scope of Impact Affected Product: WordPress Virtue Theme Affected Versions: 4.1.1 and earlier Patched Version: 4.1.2 CVSS Scores: - CVE-2024-16479: 9.8 (Critical) - CVE-2024-16478: 9.8 (Critical) Remediation 1. Immediate Upgrade: Update the Virtue theme to version 4.1.2 or higher. 2. Temporary Mitigation (if immediate upgrade is not possible): - Disable the theme's custom CSS functionality. - Use a firewall or WAF to block malicious requests to and . - Restrict access to the admin area for non-administrator users. POC Code (Exploitation Example) CVE-2024-16479 Exploitation Code CVE-2024-16478 Exploitation Code > ⚠️ Note: The code above is for demonstration purposes only. Actual exploitation requires adjusting parameters and paths based on the target environment. Do not use for illegal purposes. Additional Information Vulnerability Discoverer: Soroush Dalili (Soroush) Disclosure Date: January 15, 2024 Official Announcement: https://wordpress.org/plugins/virtue/ Patch Details: https://github.com/justinmind/virtue/commit/... (See official repository for specific commit links) --- ✅ Recommended Action: All users running Virtue theme version 4.1.1 or earlier should immediately upgrade to version 4.1.2 or higher to prevent exploitation.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Virtue Theme CVE-2024-16479/16478 Unauthenticated RCE via custom_css Parameter