CVE-2024-12855

Executive Summary

CVE-2024-12855 is a vulnerability in the AdForest WordPress theme, affecting all versions up to and including 5.1.7. The issue stems from a missing capability check on several AJAX actions, such as sb_remove_ad. This allows authenticated attackers with Subscriber-level access or higher to delete posts, attachments, and deactivate a license. The vulnerability is classified as a Missing Authorization (CWE-862) with a CVSS score of 4.3 (Medium). No public exploit code or patch details are currently available.

WordPress Ecosystem Impact

This vulnerability specifically targets the AdForest theme, a commercial WordPress theme used for classified ads websites. The missing capability check in AJAX actions allows low-privileged users (Subscribers) to perform destructive actions like deleting posts and attachments, which are typically reserved for higher-privileged roles (e.g., Editor, Administrator). This can lead to data loss and service disruption.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low EPSS score (0.0%) suggests that exploitation is not currently widespread, but the missing capability check makes it trivial for authenticated users to exploit.

Deep Dive & Mechanics

The vulnerability lies in the AdForest theme's AJAX handlers. The theme registers several AJAX actions for both authenticated and unauthenticated users. The sb_remove_ad action, among others, is intended for users with appropriate permissions (e.g., Advertisers or Administrators) to manage ads. However, the theme fails to perform a capability check (e.g., current_user_can('edit_posts')) before executing the action.

An authenticated attacker with Subscriber-level access can craft a POST request to the WordPress AJAX endpoint (wp-admin/admin-ajax.php) with the action parameter set to sb_remove_ad and the required post ID. The server will then delete the specified post and its associated attachments without verifying the user's role.

The same missing check applies to other AJAX actions, potentially allowing license deactivation.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the theme's functions.php or a dedicated AJAX handler file. A typical vulnerable pattern would be:

// Vulnerable code (no capability check)
add_action('wp_ajax_sb_remove_ad', 'sb_remove_ad_callback');
function sb_remove_ad_callback() {
    $post_id = intval($_POST['post_id']);
    wp_delete_post($post_id, true);
    wp_die();
}

A patched version would include a capability check:

// Patched code (with capability check)
add_action('wp_ajax_sb_remove_ad', 'sb_remove_ad_callback');
function sb_remove_ad_callback() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized');
    }
    $post_id = intval($_POST['post_id']);
    wp_delete_post($post_id, true);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Authenticated WordPress session with Subscriber-level access.
2. Steps:
   • Log in to WordPress as a Subscriber.
   • Obtain a valid nonce (if required) by inspecting the page source or using browser developer tools.
   • Send a POST request to wp-admin/admin-ajax.php with the following parameters:
     • action=sb_remove_ad
     • post_id=<target_post_id>
     • _ajax_nonce=<nonce_value> (if applicable)
   • The server will delete the post and its attachments.

Example cURL command:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -c cookies.txt \
  -d "action=sb_remove_ad&post_id=123&_ajax_nonce=abc123"

Blue Team (Detection & Prevention)

• Monitor AJAX requests: Look for unusual patterns in admin-ajax.php requests, especially from low-privileged users.
• Audit user roles: Ensure Subscribers do not have unnecessary capabilities.
• Implement Web Application Firewall (WAF) rules: Block requests to sb_remove_ad from non-admin users.
• Apply principle of least privilege: Restrict AJAX actions to appropriate roles.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=sb_remove_ad from Subscriber-level users.
• Logs: WordPress debug logs showing wp_delete_post calls from unexpected user roles.
• File System: Missing posts or attachments that were not deleted by an authorized user.

Detection Engineering

YARA Rule

rule CVE_2024_12855_AdForest_AJAX_Missing_Capability {
    meta:
        description = "Detects missing capability check in AdForest theme AJAX actions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12855"
    strings:
        $ajax_action = "sb_remove_ad" nocase
        $wp_delete = "wp_delete_post" nocase
        $no_cap_check = "current_user_can" nocase
    condition:
        $ajax_action and $wp_delete and not $no_cap_check
}

Sigma Rule

title: CVE-2024-12855 AdForest AJAX Missing Capability Check
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-12855 via AJAX requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=sb_remove_ad'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-12855 AdForest AJAX Missing Capability Check Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=sb_remove_ad"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the AdForest theme until a patch is available.
   • Restrict Subscriber-level users from accessing AJAX endpoints via .htaccess or server configuration.
   • Implement a Web Application Firewall (WAF) rule to block sb_remove_ad requests from non-admin users.

2. Long-term Fix:

   • Apply a patch from the vendor (AdForest) once released.
   • Manually add capability checks to the theme's AJAX handlers if you have development resources.

3. Workarounds:

   • Use a WordPress security plugin (e.g., Wordfence) to monitor and block suspicious AJAX requests.
   • Change user roles to prevent Subscribers from accessing admin-ajax.php.

Valters IT