CVE-2024-11852

Executive Summary

CVE-2024-11852 is a vulnerability in the Element Pack Elementor Addons plugin for WordPress, affecting all versions up to and including 5.10.12. The issue resides in the get_layouts() function, which fails to perform a capability check before returning a detailed listing of layout templates. This allows authenticated attackers with Subscriber-level access or higher to enumerate all available layout templates, potentially exposing sensitive design patterns, internal naming conventions, or proprietary template structures.

The vulnerability is classified as a Missing Authorization (CWE-862) and has a CVSS score of 4.3 (Medium). The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time. No public proof-of-concept (PoC) or exploit code has been released, and no patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel for a patched version. Since the plugin is part of the WordPress ecosystem, supply chain risks include potential compromise of the plugin’s update mechanism or inclusion of malicious code in future updates. Administrators should verify the integrity of plugin files and consider temporary deactivation if the risk is unacceptable.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Subscriber-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – Exposure of layout template metadata
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is considered Medium due to the low privileges required and the potential for information disclosure. While the vulnerability does not allow direct code execution or data modification, the leaked information could aid attackers in reconnaissance for more severe attacks.

Deep Dive & Mechanics

The get_layouts() function in the Element Pack plugin is intended to retrieve layout templates for use in Elementor page builder. The function is registered via a WordPress AJAX action, making it accessible to authenticated users. However, the function lacks a capability check (e.g., current_user_can('edit_posts')), allowing any authenticated user, including Subscribers, to call it.

When invoked, the function queries the database for all posts of a custom post type (likely elementor_library or similar) and returns their metadata, including titles, slugs, and possibly other sensitive fields. This enumeration can reveal:

• Internal naming conventions for templates
• Number and types of templates available
• Potential clues about other plugins or themes in use

The vulnerability is triggered by sending a POST request to /wp-admin/admin-ajax.php with the action parameter set to the AJAX hook for get_layouts(). No nonce or capability verification is performed.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.10.12):

public function get_layouts() {
    // No capability check
    $layouts = get_posts(array(
        'post_type' => 'elementor_library',
        'posts_per_page' => -1,
    ));
    wp_send_json_success($layouts);
}

Patched Code (Hypothetical):

public function get_layouts() {
    // Added capability check
    if (!current_user_can('edit_posts')) {
        wp_send_json_error('Unauthorized');
        return;
    }
    $layouts = get_posts(array(
        'post_type' => 'elementor_library',
        'posts_per_page' => -1,
    ));
    wp_send_json_success($layouts);
}

The patch adds a current_user_can('edit_posts') check to ensure only users with editing capabilities can access the layout listing. As of now, no official patch has been released.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Authenticated WordPress session with Subscriber-level access.
2. Step 1: Identify the AJAX action for get_layouts(). This can be found by inspecting the plugin’s JavaScript or source code.
3. Step 2: Send a POST request to /wp-admin/admin-ajax.php with the action parameter set to the identified hook (e.g., element_pack_ajax_get_layouts).
4. Step 3: Parse the JSON response to extract layout template details.

Example cURL command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=element_pack_ajax_get_layouts" \
  -c /tmp/cookies.txt -b /tmp/cookies.txt

Expected Response:

{
  "success": true,
  "data": [
    {
      "ID": 123,
      "post_title": "Homepage Hero",
      "post_name": "homepage-hero",
      ...
    }
  ]
}

Blue Team (Detection & Hardening)

1. Monitor AJAX Requests: Look for unusual patterns in admin-ajax.php requests, especially from low-privilege users.
2. Capability Auditing: Review all AJAX handlers in the plugin for missing capability checks.
3. Temporary Mitigation: Disable the plugin if not essential, or use a Web Application Firewall (WAF) to block requests to the vulnerable AJAX action from non-admin users.
4. Log Analysis: Check access logs for repeated calls to admin-ajax.php with the specific action parameter.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=element_pack_ajax_get_layouts (or similar) from low-privilege user sessions.
  • JSON responses containing arrays of post objects with post_type set to elementor_library.

• File IOCs:

  • Plugin file: /wp-content/plugins/bdthemes-element-pack/ (version <= 5.10.12)
  • Vulnerable function located in includes/class-layout-manager.php or similar.

• Log IOCs:

  • WordPress debug logs showing AJAX calls from Subscriber-level users to the layout endpoint.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_11852_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2024-11852 in WordPress"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-11852"
    strings:
        $ajax_action = "element_pack_ajax_get_layouts" nocase
        $admin_ajax = "admin-ajax.php" nocase
        $json_success = "\"success\":true" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-11852 Exploitation Attempt
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects attempts to exploit missing authorization in Element Pack plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=element_pack_ajax_get_layouts'
    condition: selection
falsepositives:
    - Legitimate admin usage (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-11852 - Element Pack Layout Enumeration Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=element_pack_ajax_get_layouts"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable the Element Pack plugin until a patched version is released.
2. Vendor Update: Monitor the plugin’s page on WordPress.org for updates. Apply the patch as soon as it becomes available.
3. WAF Rules: Implement a Web Application Firewall rule to block requests to admin-ajax.php with the vulnerable action parameter from non-admin users.
4. User Role Audit: Review and restrict user roles to ensure only trusted users have Subscriber-level access or higher.
5. Code Hardening: If you have developer access, add a capability check to the get_layouts() function as shown in the patched code example.

Valters IT
Securing Digital Frontiers