CVE-2024-0796

Executive Summary

CVE-2024-0796 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Active Products Tables for WooCommerce WordPress plugin, versions up to and including 1.0.6.1. The vulnerability arises from missing or incorrect nonce validation on several AJAX action functions, allowing an unauthenticated attacker to forge requests that can trick a site administrator into performing unintended actions. This could lead to unauthorized modification of plugin settings or data, though the CVSS score of 4.3 (Medium) reflects the requirement for user interaction and limited impact on integrity.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is designed to create professional product tables for WooCommerce stores. The CSRF flaw does not affect the core WordPress or WooCommerce systems but compromises the security of this third-party plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The attack is executed over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – The victim must click a link or perform an action.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Limited modification of data or settings.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the risk, but the lack of authentication for the AJAX actions makes it exploitable in phishing or social engineering scenarios.

Deep Dive & Mechanics

The vulnerability is rooted in the plugin's AJAX handlers, which are used for dynamic operations like updating product tables, saving settings, or managing configurations. In WordPress, AJAX actions should be protected by nonces (number used once) to verify that requests originate from legitimate users. The plugin fails to implement proper nonce validation on several functions, meaning any request to these endpoints is processed without verifying the source.

Attack Flow:

1. An attacker crafts a malicious link or form that triggers an AJAX request to the vulnerable plugin endpoint.
2. The attacker lures an authenticated administrator (or any user with sufficient privileges) to click the link or submit the form.
3. The victim's browser sends the forged request, including their session cookies, to the WordPress site.
4. The plugin processes the request, performing actions like changing table settings, deleting data, or modifying configurations.

Impact: An attacker could alter product table displays, disable features, or inject malicious content, potentially leading to further exploitation (e.g., stored XSS if the plugin renders user input without sanitization).

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is described generically. The plugin likely uses wp_ajax_* hooks without nonce verification.

Vulnerable Code Example (PHP):

add_action('wp_ajax_update_table', 'handle_update_table');
function handle_update_table() {
    // No nonce check
    $table_id = $_POST['table_id'];
    update_option('active_products_table_' . $table_id, $_POST['data']);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_update_table', 'handle_update_table');
function handle_update_table() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'update_table_nonce')) {
        wp_die('Security check failed');
    }
    $table_id = sanitize_text_field($_POST['table_id']);
    update_option('active_products_table_' . $table_id, $_POST['data']);
    wp_die();
}

The patch adds wp_verify_nonce() to ensure the request is intentional.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with the vulnerable plugin installed and activated.
• An authenticated administrator session (target).

Exploitation Steps:

1. Identify the vulnerable AJAX action (e.g., update_table).
2. Craft a CSRF payload. For example, an HTML form that auto-submits:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="update_table">
    <input type="hidden" name="table_id" value="1">
    <input type="hidden" name="data" value="malicious_data">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

3. Host the payload on an attacker-controlled server.
4. Send the link to the victim (e.g., via email or social engineering).
5. When the victim clicks, the request is sent with their cookies, and the action is performed.

Note: No public exploit code is available, so this is a generic demonstration.

Blue Team (Defender)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions related to the plugin (e.g., update_table, save_settings).
• Look for requests with missing or invalid nonce parameters.
• Use web application firewalls (WAF) to block requests without proper referer headers.

Prevention:

• Apply the principle of least privilege to plugin capabilities.
• Use CSRF tokens in all forms and AJAX requests.
• Educate administrators about phishing risks.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with parameters like action=update_table or action=save_settings without a valid _wpnonce field.
• Logs: WordPress debug logs showing failed nonce checks (if enabled).
• File: Modified plugin options in the wp_options table (e.g., active_products_table_*).
• Behavior: Unexpected changes to product table configurations or settings.

Detection Engineering

YARA Rule

rule CVE_2024_0796_CSRF_WordPress {
    meta:
        description = "Detects vulnerable Active Products Tables for WooCommerce plugin files missing nonce validation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-0796"
    strings:
        $ajax_action = /add_action\s*\(\s*['\"]wp_ajax_[a-z_]+['\"]/
        $nonce_check = /wp_verify_nonce/
    condition:
        $ajax_action and not $nonce_check
}

Sigma Rule

title: CVE-2024-0796 CSRF Exploitation Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects CSRF attempts against Active Products Tables for WooCommerce plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=update_table'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-0796 CSRF Attempt - Active Products Tables"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=update_table"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the plugin until a patch is available.
2. Vendor Update: Monitor the plugin's official page for a patched version (expected >1.0.6.1).
3. Workaround: Implement a web application firewall (WAF) rule to block AJAX requests to the plugin's actions without a valid nonce.
4. Code Fix: Add wp_verify_nonce() to all AJAX handlers in the plugin.
5. User Education: Train administrators to avoid clicking suspicious links and to use browser extensions that block CSRF.

Valters IT
Securing digital ecosystems through proactive threat intelligence.