CVE-2024-12176

Executive Summary

CVE-2024-12176 is a medium-severity vulnerability affecting the WordLift – AI powered SEO – Schema WordPress plugin, versions up to and including 3.54.2. The flaw resides in the wl_config_plugin AJAX action, which lacks a proper capability check. This allows unauthenticated attackers to modify the plugin’s configuration settings, potentially altering SEO metadata, schema markup, or API keys. While the CVSS score is 5.3 (Medium), the impact is limited to integrity loss (no confidentiality or availability impact). No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, given the plugin’s widespread use in WordPress SEO, the risk of automated scanning remains.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and is not an NPM, PyPI, Go, or Ruby package. No supply chain compromise has been identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – affects only the vulnerable component.
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – attacker can modify plugin settings.
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthorized configuration changes, which could be leveraged to inject malicious schema markup, redirect API calls, or disable security features. However, no direct data exfiltration or remote code execution is possible.

Deep Dive & Mechanics

The vulnerability exists in the wl_config_plugin AJAX handler, registered via wp_ajax_ and wp_ajax_nopriv_ hooks. The nopriv_ prefix indicates the action is accessible to unauthenticated users. The handler processes POST requests to update plugin settings (e.g., API keys, schema options) without verifying the user’s capabilities (e.g., manage_options).

Root Cause: Missing capability check in the callback function for the wl_config_plugin AJAX action. The code likely calls update_option() or similar functions directly without first checking current_user_can('manage_options').

Attack Flow:

1. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=wl_config_plugin and arbitrary settings payload.
2. The plugin processes the request and updates the WordPress options table.
3. The attacker can modify SEO schema, API endpoints, or disable security features.

Impact: An attacker could:

• Change the plugin’s API key to a malicious endpoint.
• Inject harmful schema markup (e.g., fake reviews, phishing links).
• Disable the plugin’s security features (if any).

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.54.2):

add_action('wp_ajax_wl_config_plugin', 'wl_config_plugin_callback');
add_action('wp_ajax_nopriv_wl_config_plugin', 'wl_config_plugin_callback');

function wl_config_plugin_callback() {
    // Missing capability check
    $settings = $_POST['settings'];
    update_option('wl_plugin_settings', $settings);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_wl_config_plugin', 'wl_config_plugin_callback');
// Remove the nopriv action to restrict to authenticated users
// add_action('wp_ajax_nopriv_wl_config_plugin', 'wl_config_plugin_callback'); // REMOVED

function wl_config_plugin_callback() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $settings = $_POST['settings'];
    update_option('wl_plugin_settings', $settings);
    wp_die();
}

Note: The official patch status is UNKNOWN. The above is a best-practice fix.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress instance with WordLift plugin <= 3.54.2 installed and activated.
• No authentication required.

Exploit Steps:

1. Identify the target WordPress site.
2. Send a crafted POST request to http://target/wp-admin/admin-ajax.php:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d "action=wl_config_plugin&settings[api_key]=MALICIOUS_KEY&settings[schema_type]=fake_review"

3. Verify the settings were updated by checking the plugin’s configuration page (if accessible) or by observing changes in the site’s schema output.

Expected Outcome: The plugin’s settings are overwritten without authentication.

Blue Team (Defense & Detection)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=wl_config_plugin from unauthenticated sources.
• Alert on changes to the wl_plugin_settings option in the database.

Mitigation:

• Apply the patch by removing the nopriv_ action and adding a capability check.
• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php with suspicious parameters.
• Restrict access to admin-ajax.php via .htaccess for non-admin IPs.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with body containing action=wl_config_plugin.
  • Unusual schema markup in HTTP responses (e.g., fake reviews, phishing links).
• Host:
  • Modified wl_plugin_settings option in the WordPress database.
  • Unexpected API keys or endpoints in the plugin’s configuration.
• Logs:
  • WordPress debug log entries showing wl_config_plugin action from unauthenticated users.

Detection Engineering

YARA Rule

rule Detect_WordLift_Config_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2024-12176 in WordLift plugin"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $ajax_action = "wl_config_plugin"
        $settings_param = "settings["
    condition:
        $ajax_action and $settings_param
}

Sigma Rule

title: WordLift Plugin Unauthenticated Config Change
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to admin-ajax.php with wl_config_plugin action
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: /wp-admin/admin-ajax.php
        cs-uri-query|contains: action=wl_config_plugin
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12176 WordLift Config Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wl_config_plugin"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the WordLift plugin until a patch is applied.
2. Patch: Update to the latest version (if available) or manually add a capability check to the wl_config_plugin callback.
3. Workaround: Remove the wp_ajax_nopriv_wl_config_plugin action from the plugin’s code.
4. Monitoring: Enable logging for admin-ajax.php requests and monitor for suspicious activity.
5. WAF: Block POST requests to admin-ajax.php with action=wl_config_plugin from non-admin IPs.

Valters IT
Securing Digital Frontiers