CVE-2024-0680

Executive Summary

CVE-2024-0680 is an information disclosure vulnerability in the WP Private Content Plus WordPress plugin (versions up to and including 3.6). The plugin fails to properly restrict access to private posts via the WordPress REST API, allowing unauthenticated attackers to view protected content. This vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No official patch has been released, and no public exploit code or Nuclei template is available.

WordPress Ecosystem Impact

This vulnerability specifically affects the WordPress ecosystem, targeting the WP Private Content Plus plugin. It does not involve Apache or Nginx server configurations.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The vulnerability allows unauthenticated access to private posts, leading to information disclosure. The low EPSS score suggests limited active exploitation.

Deep Dive & Mechanics

The WP Private Content Plus plugin provides functionality to make posts private, restricting access to authorized users. However, the plugin does not properly enforce access controls on the WordPress REST API endpoints. When a post is marked as private, the plugin fails to check user permissions before returning post data via REST API requests.

Root Cause: The plugin's REST API callback does not validate user capabilities before returning private post content. This allows unauthenticated attackers to enumerate and read private posts by directly querying the REST API.

Attack Vector: An attacker can send a GET request to /wp-json/wp/v2/posts?status=private or similar endpoints to retrieve private posts without authentication.

Vulnerable vs. Patched Code

Vulnerable Code (WP Private Content Plus <= 3.6):

// In the plugin's REST API handler
function wppcp_rest_api_callback($request) {
    $post_id = $request->get_param('id');
    $post = get_post($post_id);
    // No permission check for private posts
    return $post;
}

Patched Code (Hypothetical fix):

function wppcp_rest_api_callback($request) {
    $post_id = $request->get_param('id');
    $post = get_post($post_id);
    // Check if post is private and user has permission
    if ($post->post_status === 'private' && !current_user_can('read_private_posts')) {
        return new WP_Error('rest_forbidden', 'You do not have permission to view this post.', array('status' => 403));
    }
    return $post;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP Private Content Plus plugin version <= 3.6
• At least one private post created

Exploitation Steps:

1. Identify the target WordPress site with the vulnerable plugin.
2. Enumerate private posts via REST API:

   curl -X GET "http://target.com/wp-json/wp/v2/posts?status=private"
   

3. If the above returns results, extract private post content:

   curl -X GET "http://target.com/wp-json/wp/v2/posts/<post_id>"
   

4. Alternatively, use a more comprehensive enumeration:

   curl -X GET "http://target.com/wp-json/wp/v2/posts?per_page=100&status=private"
   

Expected Output: JSON response containing private post titles, content, and metadata.

Blue Team

Detection Steps:

1. Monitor REST API requests for unusual patterns:
   • Requests to /wp-json/wp/v2/posts with status=private parameter
   • High volume of requests to post endpoints from unauthenticated users
2. Check server logs for 403 errors on private post endpoints (if patched)
3. Review plugin version and apply temporary workaround

Honeypot Setup:

• Create a fake private post with a unique string (e.g., "HONEYPOT-2024-0680")
• Monitor for access to this post via REST API

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-json/wp/v2/posts?status=private
• HTTP requests to /wp-json/wp/v2/posts/<id> where <id> corresponds to private posts
• User-Agent strings from common scanning tools (e.g., curl, python-requests)

File IOCs:

• Plugin file: /wp-content/plugins/wp-private-content-plus/wp-private-content-plus.php (version <= 3.6)

Log IOCs:

• Access logs showing 200 responses to private post REST API endpoints from unauthenticated users

Detection Engineering

YARA Rule

rule CVE_2024_0680_WP_Private_Content_Plus {
    meta:
        description = "Detects WP Private Content Plus plugin version <= 3.6 vulnerable to CVE-2024-0680"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0680"
    strings:
        $plugin_header = "WP Private Content Plus"
        $version_string = /Version: 3\.[0-6]/
        $rest_callback = "wppcp_rest_api_callback"
    condition:
        $plugin_header and $version_string and $rest_callback
}

Sigma Rule

title: CVE-2024-0680 - WP Private Content Plus REST API Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated access to private posts via WordPress REST API
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/wp-json/wp/v2/posts'
        cs-uri-query|contains: 'status=private'
    condition: selection
falsepositives:
    - Legitimate admin access (should be authenticated)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0680 - WP Private Content Plus REST API Information Disclosure"; flow:to_server; content:"GET"; http_method; content:"/wp-json/wp/v2/posts"; http_uri; content:"status=private"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Private Content Plus plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests to /wp-json/wp/v2/posts with status=private parameter from unauthenticated users.
3. Restrict REST API access to authenticated users only using plugins like "WP REST API Authentication".

Long-term Fix:

• Monitor the plugin's official repository for a patched version.
• Apply the hypothetical patch shown in the Vulnerable vs. Patched Code section.
• Consider using alternative plugins for private content management.

Workaround:

• Add the following code to your theme's functions.php to block unauthenticated REST API access to private posts:

add_filter('rest_pre_dispatch', function($result, $server, $request) {
    if ($request->get_route() === '/wp/v2/posts' && !is_user_logged_in()) {
        return new WP_Error('rest_not_logged_in', 'You must be logged in.', array('status' => 401));
    }
    return $result;
}, 10, 3);

Valters IT
Securing Digital Frontiers