CVE-2024-0324

Executive Summary

CVE-2024-0324 is a critical missing capability check vulnerability in the User Profile Builder WordPress plugin (by Cozmoslabs) affecting all versions up to and including 3.10.8. The flaw resides in the wppb_two_factor_authentication_settings_update function, which lacks proper authorization checks. This allows unauthenticated attackers to enable or disable the Two-Factor Authentication (2FA) functionality for arbitrary user roles, specifically in the Premium version of the plugin. The vulnerability has a CVSS score of 8.2 (High) due to its low attack complexity and network-based exploitation without authentication. Although the EPSS score is currently 0.0%, the potential for privilege escalation and account takeover makes this a significant threat for WordPress sites using the premium plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and premium marketplaces. Since the plugin is not an NPM, PyPI, Go, or Ruby package, supply chain risks are limited to the WordPress ecosystem. However, users who installed the plugin via Composer or custom repositories should verify their source integrity. No known malicious packages have been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
• Base Score: 8.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – 2FA can be disabled, reducing security
• Availability Impact: High (A:H) – 2FA can be disabled, potentially leading to account lockouts or bypass

Threat Level: High. The vulnerability allows unauthenticated attackers to manipulate 2FA settings, which can lead to account takeover if combined with other attacks (e.g., password guessing). The lack of a patch increases the risk.

Deep Dive & Mechanics

The vulnerability exists in the wppb_two_factor_authentication_settings_update AJAX action handler. This function is intended to be called by administrators to enable or disable 2FA for specific user roles. However, the function does not perform a current_user_can() or wp_verify_nonce() check, allowing any unauthenticated user to send a crafted POST request to toggle 2FA settings.

Root Cause: Missing capability check (CWE-862) in the function definition. The code likely resembles:

add_action('wp_ajax_wppb_two_factor_authentication_settings_update', 'wppb_two_factor_authentication_settings_update');
add_action('wp_ajax_nopriv_wppb_two_factor_authentication_settings_update', 'wppb_two_factor_authentication_settings_update');

The nopriv hook allows unauthenticated access, and the function does not verify user permissions.

Attack Flow:

1. Attacker identifies a WordPress site running the vulnerable plugin.
2. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=wppb_two_factor_authentication_settings_update and parameters like role=administrator&enabled=0.
3. The plugin updates the option wppb_two_factor_authentication_roles to disable 2FA for the specified role.
4. Attacker can then brute-force or guess the administrator password without 2FA protection.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.10.8):

function wppb_two_factor_authentication_settings_update() {
    $role = sanitize_text_field($_POST['role']);
    $enabled = intval($_POST['enabled']);
    $settings = get_option('wppb_two_factor_authentication_roles', array());
    if ($enabled) {
        $settings[$role] = true;
    } else {
        unset($settings[$role]);
    }
    update_option('wppb_two_factor_authentication_roles', $settings);
    wp_die();
}
add_action('wp_ajax_wppb_two_factor_authentication_settings_update', 'wppb_two_factor_authentication_settings_update');
add_action('wp_ajax_nopriv_wppb_two_factor_authentication_settings_update', 'wppb_two_factor_authentication_settings_update');

Patched Code (Hypothetical):

function wppb_two_factor_authentication_settings_update() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    if (!wp_verify_nonce($_POST['_wpnonce'], 'wppb_2fa_settings')) {
        wp_die('Invalid nonce', 403);
    }
    $role = sanitize_text_field($_POST['role']);
    $enabled = intval($_POST['enabled']);
    $settings = get_option('wppb_two_factor_authentication_roles', array());
    if ($enabled) {
        $settings[$role] = true;
    } else {
        unset($settings[$role]);
    }
    update_option('wppb_two_factor_authentication_roles', $settings);
    wp_die();
}
add_action('wp_ajax_wppb_two_factor_authentication_settings_update', 'wppb_two_factor_authentication_settings_update');
// Remove the nopriv hook to prevent unauthenticated access

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with User Profile Builder Premium plugin version <= 3.10.8.
• Attacker has network access to the site.

Exploit Steps:

1. Identify the target site's admin-ajax.php endpoint.
2. Send a POST request to disable 2FA for the administrator role:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=wppb_two_factor_authentication_settings_update&role=administrator&enabled=0"

3. Verify the setting changed by checking the response (should be empty or success).
4. Attempt to brute-force the admin password using tools like Hydra or WPScan.

Note: No public exploit code exists, but the above curl command is sufficient.

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=wppb_two_factor_authentication_settings_update from unauthenticated sources.
• Alert on changes to the wppb_two_factor_authentication_roles option in the database.

Hardening:

• Disable the plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with the vulnerable action parameter from non-admin IPs.
• Use a security plugin like Wordfence to add virtual patching.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with body containing action=wppb_two_factor_authentication_settings_update.
  • Source IPs not associated with known administrators.
• File IOCs:
  • Modified wp_options table entry wppb_two_factor_authentication_roles with unexpected role settings.
• Log IOCs:
  • WordPress debug log entries showing wppb_two_factor_authentication_settings_update called without authentication.

Detection Engineering

YARA Rule

rule CVE_2024_0324_WordPress_Plugin {
    meta:
        description = "Detects exploitation attempts for CVE-2024-0324 in User Profile Builder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0324"
    strings:
        $ajax_action = "wppb_two_factor_authentication_settings_update"
        $role_param = "role="
        $enabled_param = "enabled="
    condition:
        $ajax_action and $role_param and $enabled_param
}

Sigma Rule

title: CVE-2024-0324 - Unauthenticated 2FA Setting Modification
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to WordPress admin-ajax.php with the vulnerable action parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=wppb_two_factor_authentication_settings_update"
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is added in future)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0324 - WordPress User Profile Builder 2FA Setting Exploit"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=wppb_two_factor_authentication_settings_update"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if 2FA is not critical, or restrict access to the admin-ajax.php endpoint via .htaccess or WAF.
2. Apply virtual patching using a WAF to block requests containing wppb_two_factor_authentication_settings_update from unauthenticated users.
3. Monitor logs for exploitation attempts and review user role settings.

Long-term Fix:

• The vendor (Cozmoslabs) must release a patched version that adds capability checks and nonce verification. Until then, consider migrating to an alternative 2FA plugin like "Two Factor Authentication" by Wordfence.

Workaround:

• Add the following code to the theme's functions.php to block unauthenticated access:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX && isset($_POST['action']) && $_POST['action'] === 'wppb_two_factor_authentication_settings_update') {
        if (!current_user_can('manage_options')) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT
DevSecOps & Cyber Threat Intelligence