CVE-2024-11911

Executive Summary

CVE-2024-11911 is a Missing Authorization vulnerability in the WP Crowdfunding plugin for WordPress, affecting all versions up to and including 2.1.12. The flaw resides in the install_woocommerce_plugin() function, which lacks a proper capability check. This allows authenticated attackers with Subscriber-level access or higher to install the WooCommerce plugin without authorization. While the impact is limited because WooCommerce is a required dependency for the plugin, the vulnerability still represents a security gap that could be leveraged in broader attack chains.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The WP Crowdfunding plugin is distributed via the official WordPress plugin repository. No supply chain compromise of the plugin itself has been reported, but the missing capability check introduces a risk of unauthorized plugin installation, which could be used to install a malicious version of WooCommerce if an attacker controls the plugin source.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (unauthorized plugin installation)
• Availability Impact: None

Threat Level: Medium. The vulnerability is easy to exploit but has limited direct impact. However, it could be chained with other vulnerabilities to achieve greater compromise.

Deep Dive & Mechanics

The WP Crowdfunding plugin includes a function install_woocommerce_plugin() intended to automate the installation of WooCommerce, a required dependency. This function is hooked to an AJAX action or similar endpoint without verifying that the requesting user has the necessary administrative privileges (e.g., install_plugins capability). As a result, any authenticated user, even with Subscriber-level permissions, can trigger the installation of WooCommerce.

Root Cause: The function does not call current_user_can('install_plugins') or similar capability checks before executing the plugin installation routine.

Attack Scenario:

1. An attacker registers or compromises a Subscriber account.
2. The attacker sends a crafted request to the vulnerable endpoint (e.g., admin-ajax.php?action=install_woocommerce).
3. The plugin installs WooCommerce from the WordPress repository.
4. While WooCommerce itself is legitimate, the attacker could potentially exploit this to install a malicious plugin if the function is modified or if the attacker can control the plugin source (e.g., via a compromised update channel).

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.1.12):

function install_woocommerce_plugin() {
    // No capability check
    include_once( ABSPATH . 'wp-admin/includes/plugin-install.php' );
    include_once( ABSPATH . 'wp-admin/includes/class-wp-upgrader.php' );
    // ... installation logic
}

Patched Code (Hypothetical):

function install_woocommerce_plugin() {
    if ( ! current_user_can( 'install_plugins' ) ) {
        wp_die( 'Unauthorized' );
    }
    include_once( ABSPATH . 'wp-admin/includes/plugin-install.php' );
    include_once( ABSPATH . 'wp-admin/includes/class-wp-upgrader.php' );
    // ... installation logic
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with WP Crowdfunding <= 2.1.12 installed.
• A valid Subscriber account (or higher).

Exploitation Steps:

1. Log in as a Subscriber.
2. Craft a POST request to wp-admin/admin-ajax.php with the action parameter set to the vulnerable function (e.g., action=install_woocommerce).
3. The plugin will install WooCommerce without requiring admin privileges.

Example cURL Command:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=install_woocommerce" \
  --cookie "wordpress_logged_in_<hash>=<subscriber_cookie>"

Note: No public exploit code is available at this time.

Blue Team

Detection:

• Monitor for unexpected plugin installations, especially WooCommerce, initiated by non-admin users.
• Look for AJAX requests to admin-ajax.php with action parameters related to plugin installation (e.g., install_woocommerce).

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri=*admin-ajax.php* action=install_woocommerce*
| stats count by src_ip, user, uri

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=install_woocommerce from non-admin users.
• File System: Unexpected presence of the WooCommerce plugin directory (wp-content/plugins/woocommerce/) without corresponding admin activity.
• Logs: WordPress debug logs showing plugin installation attempts by Subscriber-level users.

Detection Engineering

YARA Rule

rule CVE_2024_11911_WP_Crowdfunding {
    meta:
        description = "Detects vulnerable WP Crowdfunding plugin code"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11911"
    strings:
        $func = "install_woocommerce_plugin" nocase
        $no_check = "current_user_can" nocase
    condition:
        $func and not $no_check
}

Sigma Rule

title: CVE-2024-11911 - Unauthorized Plugin Installation via WP Crowdfunding
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit missing authorization in WP Crowdfunding plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "action=install_woocommerce"
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-11911 - WP Crowdfunding Unauthorized Plugin Installation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=install_woocommerce"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version becomes available, update immediately.
2. Disable the plugin: If WooCommerce is not required, deactivate and uninstall WP Crowdfunding.
3. Restrict user roles: Ensure Subscriber accounts have minimal privileges and cannot access AJAX endpoints.

Long-term Mitigation:

• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=install_woocommerce from non-admin users.
• Monitor for unauthorized plugin installations using security plugins like Wordfence or Sucuri.
• Apply the principle of least privilege to all user roles.

Patch Status: No official patch is available. The vendor has not responded. Consider forking the plugin or replacing it with an alternative.

Valters IT
Securing Digital Frontiers