CVE-2024-10520

Executive Summary

CVE-2024-10520 is a missing authorization vulnerability in the WordPress plugin WP Project Manager version 2.6.14. The plugin fails to perform proper capability checks in the check method of the Create_Milestone, Create_Task_List, Create_Task, and Delete_Task classes. This allows unauthenticated attackers to create milestones, task lists, tasks, or delete tasks in any project. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available. The vendor has not released a complete patch; version 2.6.14 only partially addresses the issue.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and can be installed directly from the WordPress admin dashboard. Users should verify they are running a patched version beyond 2.6.14. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The vulnerability allows unauthorized modification of data (creating or deleting tasks/milestones) but does not allow data exfiltration or denial of service.

Deep Dive & Mechanics

The vulnerability resides in the check method of four classes within the WP Project Manager plugin. These classes handle the creation and deletion of milestones, task lists, and tasks. The check method is intended to verify user capabilities before performing sensitive actions. However, in version 2.6.14, the capability check is missing or improperly implemented, allowing unauthenticated users to call these methods directly via HTTP requests.

The plugin likely uses WordPress AJAX actions or REST API endpoints to handle these operations. Without proper nonce verification and capability checks, an attacker can craft requests to create or delete project items. The partial fix in 2.6.14 may have addressed some endpoints but left others vulnerable.

Vulnerable vs. Patched Code

Vulnerable Code (2.6.14):

class Create_Milestone {
    public function check() {
        // Missing capability check
        return true;
    }
}

Patched Code (hypothetical):

class Create_Milestone {
    public function check() {
        if (!current_user_can('manage_options')) {
            return false;
        }
        return true;
    }
}

The patched version should include a call to current_user_can() or similar WordPress capability function to ensure only authorized users can perform these actions.

Exploitation & Lab Setup

Red Team

1. Setup: Install WordPress with WP Project Manager plugin version 2.6.14 on a local or cloud instance.
2. Reconnaissance: Identify the AJAX actions or REST endpoints used by the plugin. Look for actions like wp_project_manager_create_milestone, wp_project_manager_create_task_list, wp_project_manager_create_task, wp_project_manager_delete_task.
3. Exploitation: Send a crafted HTTP POST request without authentication:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   action=wp_project_manager_create_milestone&project_id=1&title=Malicious+Milestone
   

4. Verification: Check the WordPress dashboard to confirm the milestone was created.

Blue Team

1. Detection: Monitor for unusual AJAX requests to admin-ajax.php with actions related to WP Project Manager from unauthenticated sources.
2. Logging: Enable WordPress debug logging and monitor for failed capability checks.
3. Honeypot: Create a fake project with milestones and monitor for unauthorized creation/deletion.
4. Mitigation: Implement a Web Application Firewall (WAF) rule to block requests to these endpoints from unauthenticated users.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with parameters containing action=wp_project_manager_create_milestone, action=wp_project_manager_create_task_list, action=wp_project_manager_create_task, or action=wp_project_manager_delete_task from IPs not associated with authenticated users.
• File: Unexpected milestones, task lists, or tasks appearing in projects without corresponding user activity.
• Log: WordPress debug log entries showing wp_ajax_nopriv_* actions being called without proper authentication.

Detection Engineering

YARA Rule

rule CVE_2024_10520_WP_Project_Manager
{
    meta:
        description = "Detects exploitation attempts for CVE-2024-10520 in WP Project Manager plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10520"
    strings:
        $action1 = "wp_project_manager_create_milestone"
        $action2 = "wp_project_manager_create_task_list"
        $action3 = "wp_project_manager_create_task"
        $action4 = "wp_project_manager_delete_task"
        $ajax = "admin-ajax.php"
    condition:
        any of ($action*) and $ajax
}

Sigma Rule

title: CVE-2024-10520 WP Project Manager Unauthorized Actions
id: 8a7b3c2d-1e5f-4a6b-9c8d-7e0f1a2b3c4d
status: experimental
description: Detects unauthenticated AJAX requests to WP Project Manager endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains:
            - 'action=wp_project_manager_create_milestone'
            - 'action=wp_project_manager_create_task_list'
            - 'action=wp_project_manager_create_task'
            - 'action=wp_project_manager_delete_task'
    condition: selection
falsepositives:
    - Legitimate admin actions (should be authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10520 WP Project Manager Unauthorized AJAX Request"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wp_project_manager_create_milestone"; http_client_body; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-10520 WP Project Manager Unauthorized AJAX Request"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wp_project_manager_create_task_list"; http_client_body; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-10520 WP Project Manager Unauthorized AJAX Request"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wp_project_manager_create_task"; http_client_body; nocase; sid:1000003; rev:1;)
alert http any any -> any any (msg:"CVE-2024-10520 WP Project Manager Unauthorized AJAX Request"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wp_project_manager_delete_task"; http_client_body; nocase; sid:1000004; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the WP Project Manager plugin until a complete patch is available.
2. Short-term: Implement a WAF rule to block unauthenticated requests to the vulnerable AJAX endpoints.
3. Long-term: Apply the vendor's patch when released. If no patch is forthcoming, consider replacing the plugin with an alternative.
4. Workaround: Add custom code to the theme's functions.php to enforce capability checks:

   add_action('wp_ajax_nopriv_wp_project_manager_create_milestone', function() {
       wp_die('Unauthorized', 403);
   }, 1);
   

5. Monitoring: Continuously monitor for exploitation attempts using the provided detection rules.

Valters IT
Securing Digital Frontiers