Seeded CVEs

Two CVE paths exist. Direct matches are explicit patterns evaluated in Lua before the request is routed, so they can force a honeypot diversion on their own. Suricata alerts contribute severity-graded deltas from observed network traffic. Both paths feed the same risk score and the same AbuseIPDB reporting decision.

Direct CVE Matches (via vulnerability_rules.lua)

The following CVEs are explicitly matched via URI/argument pattern analysis in the vulnerability rules. vulnerability_rules.detect_vulnerability_pattern() returns an object with cve, severity, description, plugin, attack_vector for each matched pattern.

CVE ID	Severity	Plugin	Attack Vector	Match Condition
CVE-2023-28121	HIGH	woocommerce-payments	header_manipulation	URI contains wp-json/wp/v2/users AND X-WCPAY-PLATFORM-CHECKOUT-USER header
CVE-2023-2986	HIGH	abandoned-cart-lite	encryption_bypass	URI/args contain wcal_action=checkout_link AND validate=
CVE-2025-4403	CRITICAL	drag-and-drop-multiple-file-upload	file_upload_bypass	URI/args contain dnd_codedropz_upload AND supported_type
CVE-2025-2266	CRITICAL	cwmp	privilege_escalation	URI/args contain cwmpupdateoptions
CVE-2025-47577	CRITICAL	gift-voucher	file_upload_rce	URI/args contain mwb_wgm_preview_mail
CVE-2024-2387	HIGH	advanced-form-integration	sql_injection	URI contains advanced-form-integration-log AND args contain integration_id with quote/union/select
CVE-2025-10142	HIGH	pagseguro-connect-woocommerce	path_traversal	URI/args contain pc_added_uploaded_image AND file[path]
CVE-2024-50508	HIGH	wp-file-upload	directory_traversal	URI/args contain file[path] AND (../ or /etc/)
GENERIC-WP-001	CRITICAL	wordpress-core	sensitive_file_access	URI contains wp-config.php
GENERIC-WP-002	HIGH	wordpress-core	installation_abuse	URI contains wp-admin/install.php or setup-config.php
GENERIC-WP-003	MEDIUM	wordpress-core	information_disclosure	URI contains wp-json/wp/v2/users or author=digits
GENERIC-WP-004	MEDIUM	wordpress-core	xmlrpc_abuse	URI contains xmlrpc.php

Additional CVE patterns in _G.config.vulnerability.cve_patterns (init.lua): CVE-2024-25600 (Bricks Builder RCE), CVE-2024-27956 (WP Automatic SQLi), CVE-2024-1071 (Ultimate Member SQLi), CVE-2022-0739 (BookingPress SQLi), CVE-2024-2879 (LayerSlider SQLi).

CVE-2024-8425 shares the same Gift Voucher upload pattern as CVE-2025-47577 and is noted as an alias in code comments, but vulnerability_rules.lua only ever returns CVE-2025-47577 for that match — it is not an independently-matched 14th CVE. The Suricata layer does detect it separately (see Suricata Network IDS, SID 1000010), since its signature matches on a distinct PHP-upload body pattern rather than the URI.

Suricata Alert-Based Detections

The second CVE path is network evidence: Suricata's CVE signatures (SIDs 1000001–1000016) raise the source IP's reputation by severity (1 → +50, 2 → +25, otherwise +10, capped at 100), and a flagged IP is diverted at routing stage 6. The reason string carries the signature, so a Suricata-confirmed IP maps to the suricata_confirmed_alert AbuseIPDB reason below. Parsing, private-IP filtering and decay are on Suricata Network IDS.

AbuseIPDB Reportability Mapping

Honeypot Reason	Categories	Description
cve_pattern_match	15, 21	CVE pattern detected via URL/argument matching
vulnerable_plugin_access	15, 21	Access on plugins known to have specific CVEs
multiple_admin_attempts	18	Indicators of brute-force attempts
rapid_automation_detected	19	Signatures of malicious bots
suspicious_file_upload	21	File upload vector anomalies
suricata_confirmed_alert	15, 21	An IP confirmed via Suricata alert

Report Comment Format: Honeypot detection: [Honeypot Reason] (CVEs: [List of Matched CVEs])

Adding a CVE

Seeding a new vulnerability is deliberately boring. Pick the narrowest signature that proves the exploit attempt, then add it to both the Lua rules and the matching Suricata rule where possible.

1. Confirm the request shape. Record the vulnerable endpoint, the required argument or header, and a benign request to the same endpoint that must not match.
2. Add a Lua pattern. Extend vulnerability_rules.lua (or cve_patterns in init.lua) with the CVE identifier, severity, plugin, attack vector and description.
3. Add a Suricata signature. Allocate the next SID in the appropriate range and align it with the WSTG category.
4. Add a unit test. Cover a positive match, a negative request and the reported fields. Run the suite under plain Lua.
5. Update the table. Add the CVE to this page so operators know what the deployment recognises.
6. Regenerate the catalogue. Rebuild patterns/patterns.json so the new CVE appears in the dashboard and on the Pattern Database page without the two lists drifting apart.

A rule in vulnerability_rules.lua returns the fields the reporters and the dashboard expect:

-- CVE-2023-2986: Abandoned Cart Lite Hardcoded Encryption Key
if string.find(combined, "wcal_action=checkout_link") and
   string.find(combined, "validate=") then
    return {
        cve = "CVE-2023-2986",
        severity = "HIGH",
        description = "Abandoned Cart Lite exploitation using hardcoded encryption key",
        plugin = "abandoned-cart-lite",
        attack_vector = "encryption_bypass"
    }
end

The quick-match table in init.lua takes one Lua pattern per CVE (escape - and .):

cve_patterns = {
    ["CVE-2023-28121"] = "X%-WCPAY%-PLATFORM%-CHECKOUT%-USER",
    ["CVE-2023-2986"] = "wcal_action=checkout_link",
    ["CVE-2024-25600"] = "bricks/v1/render_element",
    -- ...

And the matching test in tests/test_vulnerability_rules.lua, with its negative case:

local cve2 = rules.detect_vulnerability_pattern("/", "wcal_action=checkout_link&validate=x", nil)
check("CVE-2023-2986 detected", cve2 ~= nil and cve2.cve == "CVE-2023-2986")

local clean = rules.detect_vulnerability_pattern("/shop/product/red-shirt", nil, nil)
check("clean uri returns nil", clean == nil)

Honest Assessment

Strengths: 13 seeded CVEs across multiple exploit vectors, severity-graded Suricata integration, AbuseIPDB reportability for 6 reason types.

Limitations: Coverage limited to seeded CVEs (manual addition required), Suricata same-host testing gap, generic patterns may need tuning for new WordPress versions.