CVE-2024-12329

Executive Summary

CVE-2024-12329 is a missing authorization vulnerability in the Essential Real Estate WordPress plugin, affecting all versions up to and including 5.1.6. The plugin fails to perform capability checks on several pages and post types, allowing authenticated attackers with Contributor-level access or higher to access sensitive data such as invoices and transaction logs. This vulnerability is classified as a Broken Access Control issue (CWE-862) and has a CVSS score of 4.3 (Medium). No public proof-of-concept or patch details are currently available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel for a patched version. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (unauthorized data access)
• Integrity Impact: None
• Availability Impact: None

The low EPSS score (0.0%) suggests this vulnerability is not currently being actively exploited in the wild, but the potential for data leakage remains a concern.

Deep Dive & Mechanics

The Essential Real Estate plugin registers several custom post types and admin pages to manage property listings, invoices, and transaction logs. The vulnerability stems from the lack of a current_user_can() or similar capability check on these endpoints. Specifically, the plugin’s admin pages for viewing invoices and transaction logs do not verify that the authenticated user has the required administrative privileges (e.g., manage_options or edit_others_posts). As a result, any user with at least Contributor-level access can access these pages by directly navigating to their URLs.

The affected endpoints likely include:

• /wp-admin/admin.php?page=essential-real-estate-invoices
• /wp-admin/admin.php?page=essential-real-estate-transactions

An attacker with Contributor-level credentials can enumerate these pages and extract sensitive financial data, including client billing information and transaction histories.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below. A patched version would include a capability check before rendering sensitive data.

Vulnerable Code (example from plugin):

add_action('admin_menu', function() {
    add_submenu_page(
        'essential-real-estate',
        'Invoices',
        'Invoices',
        'read', // Incorrect: allows any authenticated user
        'essential-real-estate-invoices',
        'render_invoices_page'
    );
});

function render_invoices_page() {
    // No capability check here
    $invoices = get_invoices();
    foreach ($invoices as $invoice) {
        echo esc_html($invoice->details);
    }
}

Patched Code (hypothetical):

add_action('admin_menu', function() {
    add_submenu_page(
        'essential-real-estate',
        'Invoices',
        'Invoices',
        'manage_options', // Correct: restricts to administrators
        'essential-real-estate-invoices',
        'render_invoices_page'
    );
});

function render_invoices_page() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // ... rest of the function
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: Obtain a WordPress account with Contributor-level privileges on a site running Essential Real Estate <= 5.1.6.
2. Enumerate Admin Pages: Use a tool like wpscan or manually browse to:
   • /wp-admin/admin.php?page=essential-real-estate-invoices
   • /wp-admin/admin.php?page=essential-real-estate-transactions
3. Extract Data: If the pages load without redirecting to the login screen, the vulnerability is present. Copy the displayed invoice and transaction data.

Example cURL command:

curl -c cookies.txt -b cookies.txt \
  "http://target/wp-admin/admin.php?page=essential-real-estate-invoices" \
  | grep -oP '(?<=<td>).*?(?=</td>)'

Blue Team

1. Monitor Access Logs: Look for requests to /wp-admin/admin.php with page=essential-real-estate-invoices or page=essential-real-estate-transactions from non-admin user agents.
2. Audit User Roles: Review all Contributor-level users for suspicious activity.
3. Temporary Mitigation: Use a WordPress security plugin (e.g., Wordfence) to block access to these pages for non-admin roles.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /wp-admin/admin.php?page=essential-real-estate-invoices
  • /wp-admin/admin.php?page=essential-real-estate-transactions
• User Agents: Standard browser user agents (e.g., Mozilla/5.0) from non-admin IPs accessing admin pages.
• Log Entries: HTTP 200 responses to the above URLs from users with role contributor or author.

Detection Engineering

YARA Rule

rule Detect_Essential_Real_Estate_Access_Bypass {
    meta:
        description = "Detects attempts to access unauthorized admin pages in Essential Real Estate plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-12329"
    strings:
        $page1 = "essential-real-estate-invoices"
        $page2 = "essential-real-estate-transactions"
        $admin_url = "/wp-admin/admin.php"
    condition:
        all of ($page*) and #admin_url > 0
}

Sigma Rule

title: Essential Real Estate Unauthorized Admin Page Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects access to sensitive admin pages by non-admin users
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'page=essential-real-estate-invoices'
            - 'page=essential-real-estate-transactions'
    condition: selection
falsepositives:
    - Legitimate admin access
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12329 Essential Real Estate Unauthorized Access"; flow:to_server,established; content:"/wp-admin/admin.php"; http_uri; content:"page=essential-real-estate-invoices"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Essential Real Estate plugin until a patched version is released.
2. Short-term Mitigation: Use a Web Application Firewall (WAF) to block access to the vulnerable admin pages for non-admin roles.
3. Long-term Fix: Apply the vendor patch when available. If no patch is forthcoming, consider replacing the plugin with an alternative.
4. User Audit: Review all Contributor-level accounts and remove any that are not essential.
5. Monitoring: Enable detailed logging for admin page access and review logs regularly.

Valters IT
Securing Digital Frontiers