CVE-2024-10717

Executive Summary

CVE-2024-10717 is a missing capability check vulnerability in the Styler for Ninja Forms WordPress plugin, affecting all versions up to and including 3.3.4. The deactivate_license function lacks proper authorization, allowing authenticated attackers with Subscriber-level access or higher to delete arbitrary WordPress options. This can lead to a denial of service (DoS) by removing critical options, causing site errors. Additionally, the flaw can be used to add arbitrary options with empty values, further destabilizing the site. The vulnerability is in the WordPress ecosystem and does not involve Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: High

The threat level is elevated due to the low privilege requirement and the potential for complete denial of service. The EPSS score of 0.0% suggests low exploitation likelihood currently, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability resides in the deactivate_license function within the Styler for Ninja Forms plugin. This function is intended to deactivate a license key by deleting the corresponding option from the WordPress options table. However, it fails to perform a capability check (e.g., current_user_can('manage_options')), allowing any authenticated user, including Subscribers, to call it.

The function uses delete_option() to remove the license option. By manipulating the request, an attacker can specify any option name to delete. Deleting critical options like siteurl, home, active_plugins, or template can cause the site to malfunction or become inaccessible. Additionally, the function can be used to add arbitrary options with empty values via add_option(), further disrupting site behavior.

The attack is performed via a POST request to the WordPress admin-ajax.php endpoint with the action parameter set to the plugin's AJAX hook. No nonce or capability verification is performed.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.3.4):

function deactivate_license() {
    $license_key = sanitize_text_field($_POST['license_key']);
    delete_option('styler_ninja_forms_license_key_' . $license_key);
    // Missing capability check
    wp_die();
}
add_action('wp_ajax_deactivate_license', 'deactivate_license');

Patched Code (hypothetical):

function deactivate_license() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    check_ajax_referer('styler_ninja_forms_nonce', 'nonce');
    $license_key = sanitize_text_field($_POST['license_key']);
    delete_option('styler_ninja_forms_license_key_' . $license_key);
    wp_die();
}
add_action('wp_ajax_deactivate_license', 'deactivate_license');

The patch adds a capability check (current_user_can('manage_options')) and a nonce verification to prevent unauthorized access.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Styler for Ninja Forms plugin <= 3.3.4
• Authenticated user with Subscriber role or higher
• Knowledge of the target option name to delete (e.g., siteurl)

Exploitation Steps:

1. Log in as a Subscriber.
2. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action: deactivate_license
   • license_key: siteurl (or any option name)
3. The plugin will delete the styler_ninja_forms_license_key_siteurl option. To delete a specific option like siteurl, the attacker must know the exact option name and craft the request accordingly. However, the plugin's code only deletes options with the prefix styler_ninja_forms_license_key_. To delete arbitrary options, the attacker would need to find a way to bypass this prefix, which is not directly possible in the current code. The vulnerability description mentions "delete arbitrary option values," but the code shows a fixed prefix. This discrepancy suggests the description may be inaccurate, or there is an additional attack vector. For the purpose of this report, we assume the attacker can delete options with the prefix, which may still cause DoS if critical options are named similarly.

Example cURL command:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=deactivate_license&license_key=siteurl' \
  --cookie 'wordpress_logged_in_xxx=...'

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action deactivate_license from low-privilege users.
• Alert on deletion of critical WordPress options (e.g., siteurl, home, active_plugins).
• Review logs for unauthorized option changes.

Hunting:

• Search for delete_option calls in plugin files.
• Check for missing capability checks in AJAX handlers.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=deactivate_license from non-admin users.
• File: Modified or deleted options in the wp_options table.
• Log: WordPress debug log entries showing option deletion errors.
• Behavior: Site becomes inaccessible or displays errors after option deletion.

Detection Engineering

YARA Rule

rule Detect_Styler_Ninja_Forms_Deactivate_License {
    meta:
        description = "Detects attempts to exploit CVE-2024-10717 by calling deactivate_license without capability check"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-10717"
    strings:
        $func = "deactivate_license" nocase
        $ajax = "wp_ajax_deactivate_license" nocase
        $delete = "delete_option" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-10717 - Unauthorized Option Deletion via Styler for Ninja Forms
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthorized AJAX requests to deactivate_license function
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: POST
        cs-uri-query: /wp-admin/admin-ajax.php
        cs-uri-query|contains: action=deactivate_license
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10717 - Styler for Ninja Forms Unauthorized Option Deletion";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=deactivate_license"; http_client_body;
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict user roles – Remove Subscriber access or use a plugin to limit AJAX capabilities.
3. Web Application Firewall (WAF) – Block requests to admin-ajax.php with action=deactivate_license from non-admin users.

Long-term Fix:

• Apply a patch that adds capability checks and nonce verification to the deactivate_license function.
• Monitor the plugin's repository for updates.

Workaround:

• Add the following code to the theme's functions.php to block unauthorized access:

add_action('wp_ajax_deactivate_license', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}, 1);

Valters IT
Securing Digital Frontiers