CVE-2024-13425

Executive Summary

CVE-2024-13425 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Job Portal – A Complete Recruitment System for Company or Job Board website WordPress plugin, affecting all versions up to and including 2.2.6. The flaw resides in the enforcedelete() function, which fails to validate a user-controlled key, allowing authenticated attackers with Employer-level access or higher to delete companies owned by other users. This can lead to data loss and disruption of recruitment operations. The vulnerability has a CVSS score of 4.3 (Medium) and no known public exploit or patch at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates and consider disabling the plugin if immediate patching is not possible. No supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires authenticated access (Employer-level or above).
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Unauthorized deletion of company data.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium – Exploitation requires authentication but can cause significant data loss.

Deep Dive & Mechanics

The vulnerability exists in the enforcedelete() function within the WP Job Portal plugin. This function is intended to allow users to delete their own companies. However, it accepts a user-controlled key (likely a company ID or similar identifier) without verifying that the authenticated user owns the target company. An attacker with Employer-level access can manipulate this key to delete companies belonging to other users.

The core issue is a missing authorization check. The function should verify that the company_id (or equivalent parameter) belongs to the current user before performing the deletion. Without this check, any authenticated user can delete any company in the system.

Vulnerable vs. Patched Code

Vulnerable Code (wp-job-portal/includes/class-wp-job-portal-ajax.php):

public function enforcedelete() {
    $company_id = $_POST['company_id'];
    global $wpdb;
    $wpdb->delete( $wpdb->prefix . 'wpjp_company', array( 'id' => $company_id ) );
    wp_die();
}

Patched Code (Hypothetical Fix):

public function enforcedelete() {
    $company_id = intval( $_POST['company_id'] );
    $user_id = get_current_user_id();
    global $wpdb;
    $company = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}wpjp_company WHERE id = %d AND user_id = %d", $company_id, $user_id ) );
    if ( $company ) {
        $wpdb->delete( $wpdb->prefix . 'wpjp_company', array( 'id' => $company_id ) );
    }
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP Job Portal plugin (version <= 2.2.6) installed and activated.
• Two user accounts: one Employer-level (attacker) and one other user with a company.

Exploitation Steps:

1. Log in as the attacker (Employer-level).
2. Identify the target company ID (e.g., via directory enumeration or by observing other users' profiles).
3. Send a POST request to the WordPress AJAX endpoint with the action parameter set to enforcedelete and the company_id parameter set to the target company ID.

Example Request (using cURL):

curl -X POST \
  -d "action=enforcedelete&company_id=123" \
  -b "wordpress_logged_in_cookie=..." \
  http://target-site/wp-admin/admin-ajax.php

Expected Outcome: The target company is deleted without authorization.

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action=enforcedelete.
• Alert on multiple deletion attempts by the same user within a short timeframe.
• Review logs for unusual patterns in company deletion activity.

Hunting:

• Query database for deleted company records and correlate with user IDs.
• Check for missing authorization checks in custom plugin code.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=enforcedelete and a numeric company_id.
• Logs: WordPress debug log entries showing deletion of companies by users who do not own them.
• Database: Missing rows in wp_wpjp_company table without corresponding user ownership.

Detection Engineering

YARA Rule

rule CVE_2024_13425_WP_Job_Portal_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2024-13425 in WP Job Portal plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13425"
    strings:
        $ajax_action = "enforcedelete"
        $company_id = "company_id"
    condition:
        $ajax_action and $company_id
}

Sigma Rule

title: CVE-2024-13425 WP Job Portal IDOR Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to admin-ajax.php with action enforcedelete
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: 
            - "/wp-admin/admin-ajax.php"
        cs-post-body: 
            - "action=enforcedelete"
    condition: selection
falsepositives:
    - Legitimate use by site administrators (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13425 WP Job Portal IDOR Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=enforcedelete"; http_client_body;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Restrict access to the admin-ajax.php endpoint for unauthenticated or low-privilege users using a Web Application Firewall (WAF) or .htaccess rules.
3. Monitor logs for suspicious deletion activity.

Long-Term Fix:

• Apply a custom patch to add authorization checks in the enforcedelete() function (see patched code example above).
• Wait for the vendor to release an official update and apply it promptly.

Workaround:

• Use a WordPress security plugin to add role-based restrictions on AJAX actions.

Valters IT
Securing Digital Frontiers