CVE-2024-13420

Executive Summary

CVE-2024-13420 is a vulnerability affecting multiple WordPress plugins and themes distributed by Envato. The core issue is a Missing Authorization (CWE-862) in several AJAX actions, including gsf_reset_section_options, gsf_reset_section_options, and gsf_create_preset_options. This flaw allows authenticated attackers with Subscriber-level access or higher to reset and modify plugin/theme settings without proper capability checks. Despite partial patching efforts by Envato, the vulnerability remains exploitable in many instances. The CVSS score is 4.3 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept (PoC) or exploit code has been released.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem, affecting themes and plugins distributed through Envato’s marketplace. It does not involve NPM, PyPI, Go, or Ruby packages. However, the supply chain risk is significant because Envato is a major distribution platform for WordPress assets. Users who have purchased affected themes/plugins should verify they are running the latest patched versions from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the low privileges required and the potential for unauthorized modification of settings. However, the lack of public exploits and low EPSS score reduce immediate risk.

Deep Dive & Mechanics

The vulnerability resides in the AJAX handlers of multiple Envato-distributed WordPress plugins and themes. The affected AJAX actions (e.g., gsf_reset_section_options, gsf_create_preset_options) are intended for administrators to manage theme/plugin settings. However, the code fails to perform a current_user_can() check or similar capability verification before executing these actions.

Root Cause: The missing capability check allows any authenticated user, including Subscribers, to call these AJAX endpoints. Once triggered, the actions can reset settings to defaults or create new presets, potentially disrupting site functionality or introducing insecure configurations.

Attack Flow:

1. An attacker registers or compromises a Subscriber-level account on a WordPress site.
2. The attacker sends a crafted POST request to /wp-admin/admin-ajax.php with the action parameter set to one of the vulnerable actions (e.g., gsf_reset_section_options).
3. The server processes the request without verifying the user’s role, resetting or modifying the settings.

Vulnerable vs. Patched Code

Vulnerable Code (Example):

add_action('wp_ajax_gsf_reset_section_options', 'gsf_reset_section_options');
function gsf_reset_section_options() {
    // Missing capability check
    // ... reset logic ...
}

Patched Code (Expected):

add_action('wp_ajax_gsf_reset_section_options', 'gsf_reset_section_options');
function gsf_reset_section_options() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // ... reset logic ...
}

The patch adds a current_user_can('manage_options') check to ensure only administrators can execute the action. However, Envato’s partial patching means some instances may still be vulnerable.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with an affected Envato theme/plugin.
• A valid Subscriber-level account (username/password or nonce).

Exploitation Steps:

1. Log in as a Subscriber.
2. Obtain a valid AJAX nonce (if required) by inspecting the page source or using a tool like Burp Suite.
3. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action: gsf_reset_section_options
   • _ajax_nonce: (if required)
   • Additional parameters as needed by the specific action.

Example cURL Command:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -d "action=gsf_reset_section_options&_ajax_nonce=12345" \
  --cookie "wordpress_logged_in_xxx=..."

Expected Outcome: The plugin/theme settings are reset to defaults, potentially breaking the site’s appearance or functionality.

Blue Team (Detection & Prevention)

Detection:

• Monitor AJAX requests to admin-ajax.php with actions like gsf_reset_section_options, gsf_create_preset_options, etc.
• Alert on requests from non-admin users (Subscriber, Contributor, Author) to these endpoints.
• Use Web Application Firewall (WAF) rules to block requests to these actions from low-privilege users.

Prevention:

• Apply the vendor’s patch immediately.
• If no patch is available, disable the affected AJAX actions via a custom plugin or .htaccess rules.
• Restrict AJAX nonce generation to administrators only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action parameters gsf_reset_section_options, gsf_create_preset_options, or similar.
  • Repeated requests from the same IP to these endpoints from a non-admin user agent.

• Host IOCs:

  • Unexpected changes to theme/plugin settings in the WordPress database (e.g., wp_options table).
  • Log entries in wp-content/debug.log showing unauthorized AJAX calls.

• File IOCs:

  • Modified or reset configuration files in the theme/plugin directory.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_13420_AJAX_Action {
    meta:
        description = "Detects AJAX requests targeting vulnerable actions in Envato themes/plugins"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-13420"
    strings:
        $action1 = "gsf_reset_section_options"
        $action2 = "gsf_create_preset_options"
        $ajax = "admin-ajax.php"
    condition:
        all of ($action*) and $ajax
}

Sigma Rule

title: CVE-2024-13420 - Unauthorized AJAX Action Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit missing capability checks in Envato themes/plugins
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'gsf_reset_section_options'
            - 'gsf_create_preset_options'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13420 - Unauthorized AJAX Action Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"admin-ajax.php"; http.client_body; content:"gsf_reset_section_options"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the affected AJAX actions by adding the following code to your theme’s functions.php or a custom plugin:

   add_action('init', function() {
       if (current_user_can('subscriber')) {
           remove_action('wp_ajax_gsf_reset_section_options', 'gsf_reset_section_options');
           remove_action('wp_ajax_gsf_create_preset_options', 'gsf_create_preset_options');
       }
   });
   

2. Vendor Patch: Contact Envato support for the latest patched version of your theme/plugin. Apply it immediately.
3. WAF Rules: Block POST requests to admin-ajax.php containing the vulnerable action strings from non-admin IPs.
4. User Audit: Review all Subscriber-level accounts for suspicious activity and remove any unauthorized users.
5. Monitoring: Enable logging for AJAX requests and monitor for the IOCs listed above.

Valters IT
Securing Digital Ecosystems