CVE-2024-13773
Published: 14 March 2025
Summary
CVE-2024-13773 is a high-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Uxper Civi. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2024-13773 is a sensitive information exposure vulnerability affecting the Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress in all versions up to and including 2.1.4. The issue stems from hard-coded credentials within the plugin, which exposes sensitive data such as LinkedIn client and secret keys. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs 321 (Use of Hard-coded Cryptographic Key) and 798 (Use of Hard-coded Credentials).
Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction or privileges required. Successful exploitation allows extraction of the hard-coded credentials, including LinkedIn client and secret keys, potentially enabling unauthorized access to associated services or further compromise of integrated systems.
Advisories from Wordfence provide threat intelligence on the vulnerability at https://www.wordfence.com/threat-intel/vulnerabilities/id/e3499182-7501-4fec-a7c6-b66ae47533cd?source=cve. The exposure originates in the plugin's source code at http://localhost:1337/wp-content/themes/civi/includes/class-init.php#L36.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54058
Vulnerability details
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenticated attackers to extract sensitive…
more
data including LinkedIn client and secret keys.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing WordPress plugin enables remote exploitation to extract hard-coded credentials from accessible plugin source files.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of flaws like hard-coded credentials in the Civi WordPress plugin, preventing exploitation and restoring secure configuration.
Vulnerability scanning detects the hard-coded LinkedIn credentials in the plugin's source code, enabling proactive remediation of this exposure.
Enforces approval and monitoring of user-installed software, preventing deployment of vulnerable plugins like Civi containing hard-coded sensitive credentials.