PT-2025-15917 · WordPress · Wp-Geshi-Highlight

Pierre Rudloff · Published 2025-04-10 · Updated 2025-04-10 · CVE-2024-13896

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: WP-GeSHi-Highlight versions 1.4.3 and earlier

Description: The WP-GeSHi-Highlight WordPress plugin processes user-supplied input as a regular expression via the wp geshi filter replace code() function, which could lead to a Regular Expression Denial of Service (ReDoS) issue. This occurs because the plugin does not properly validate or sanitize the input, allowing an attacker to craft a malicious regular expression that could cause the plugin to consume excessive resources, leading to a denial of service.

Recommendations: For WP-GeSHi-Highlight versions 1.4.3 and earlier, consider disabling the wp geshi filter replace code() function until a patch is available to prevent potential ReDoS attacks. Restrict access to the plugin's syntax highlighting feature to minimize the risk of exploitation. Avoid using the plugin with untrusted user input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-13896

Affected Products

Wp-Geshi-Highlight

References · 5

• 🔥 https://wpscan.com/vulnerability/b8b622ea-e090-45ad-8755-b050fc055231 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-13896 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13896 · Vendor Advisory
• https://twitter.com/CVEnew/status/1910296111434399747 · Twitter Post
• https://t.me/cvenotify/118565 · Telegram Post