CVE-2024-13773

High

Published: 14 March 2025

Published

14 March 2025

Modified

27 March 2025

KEV Added

—

Patch

—

CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0015 34.9th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13773 is a high-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Uxper Civi. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and RA-5 (Vulnerability Monitoring and Scanning).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

preventrecover

Requires timely identification, reporting, and correction of flaws like hard-coded credentials in the Civi WordPress plugin, preventing exploitation and restoring secure configuration.

RA-5 Vulnerability Monitoring and Scanning good match

detect

Vulnerability scanning detects the hard-coded LinkedIn credentials in the plugin's source code, enabling proactive remediation of this exposure.

CM-11 User-installed Software good match

prevent

Enforces approval and monitoring of user-installed software, preventing deployment of vulnerable plugins like Civi containing hard-coded sensitive credentials.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1552.001 Credentials In Files Credential Access

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Vulnerability in public-facing WordPress plugin enables remote exploitation to extract hard-coded credentials from accessible plugin source files.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenticated attackers to extract sensitive…

data including LinkedIn client and secret keys.

Deeper analysisAI

CVE-2024-13773 is a sensitive information exposure vulnerability affecting the Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress in all versions up to and including 2.1.4. The issue stems from hard-coded credentials within the plugin, which exposes sensitive data such as LinkedIn client and secret keys. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs 321 (Use of Hard-coded Cryptographic Key) and 798 (Use of Hard-coded Credentials).

Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction or privileges required. Successful exploitation allows extraction of the hard-coded credentials, including LinkedIn client and secret keys, potentially enabling unauthorized access to associated services or further compromise of integrated systems.

Advisories from Wordfence provide threat intelligence on the vulnerability at https://www.wordfence.com/threat-intel/vulnerabilities/id/e3499182-7501-4fec-a7c6-b66ae47533cd?source=cve. The exposure originates in the plugin's source code at http://localhost:1337/wp-content/themes/civi/includes/class-init.php#L36.