CVE-2024-13703

Executive Summary

CVE-2024-13703 is a Missing Authorization vulnerability in the CRM and Lead Management by vcita WordPress plugin, affecting all versions up to and including 2.7.5. The flaw resides in the vcita_ajax_toggle_ae() function, which lacks a proper capability check. This allows authenticated attackers with Subscriber-level access or higher to enable or disable plugin widgets without authorization. The vulnerability has a CVSS score of 4.3 (Medium), with a low attack complexity and no requirement for user interaction. No public exploit code or proof-of-concept is currently available, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since the patch status is unknown, users are advised to monitor the plugin’s update channel and consider disabling the plugin until a fix is released. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (widget state toggling)
• Availability Impact: None

The threat level is considered Medium due to the low privileges required and the ability to disrupt widget functionality, though no data exfiltration or system compromise is possible.

Deep Dive & Mechanics

The vulnerability exists in the vcita_ajax_toggle_ae() function, which is registered as an AJAX action for authenticated users. The function is intended to toggle the active state of plugin widgets (e.g., contact forms, lead capture). However, it fails to perform a current_user_can() check or any other capability verification before executing the toggle operation.

Root Cause: The function uses wp_ajax_ hooks without verifying that the user has the appropriate administrative or editing capabilities. By default, any authenticated user (including Subscribers) can trigger AJAX actions, and the missing capability check allows unauthorized state changes.

Attack Flow:

1. An attacker authenticates as a Subscriber (or higher) on a WordPress site running the vulnerable plugin.
2. The attacker crafts a POST request to /wp-admin/admin-ajax.php with the action vcita_ajax_toggle_ae and the required parameters (e.g., widget ID, new state).
3. The server processes the request and toggles the widget state without verifying the user’s permissions.
4. The attacker can enable or disable any plugin widget, potentially disrupting lead management or customer interactions.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.7.5):

add_action('wp_ajax_vcita_ajax_toggle_ae', 'vcita_ajax_toggle_ae');
function vcita_ajax_toggle_ae() {
    // Missing capability check
    $widget_id = sanitize_text_field($_POST['widget_id']);
    $new_state = sanitize_text_field($_POST['new_state']);
    update_option('vcita_widget_' . $widget_id . '_active', $new_state);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_vcita_ajax_toggle_ae', 'vcita_ajax_toggle_ae');
function vcita_ajax_toggle_ae() {
    // Added capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $widget_id = sanitize_text_field($_POST['widget_id']);
    $new_state = sanitize_text_field($_POST['new_state']);
    update_option('vcita_widget_' . $widget_id . '_active', $new_state);
    wp_die();
}

The patch adds a current_user_can('manage_options') check to restrict the function to administrators only.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with vcita plugin <= 2.7.5
• Valid Subscriber account credentials

Exploitation Steps:

1. Log in as a Subscriber.
2. Obtain a nonce if required (the function may not use nonces, but check the source).
3. Send a POST request to toggle a widget:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=vcita_ajax_toggle_ae&widget_id=contact_form&new_state=0" \
  --cookie "wordpress_logged_in_xxx=..."

Expected Result: The widget contact_form is disabled, affecting site functionality.

Blue Team (Detection & Prevention)

Detection:

• Monitor AJAX requests to admin-ajax.php with action vcita_ajax_toggle_ae from non-admin users.
• Alert on rapid toggling of widget states.

Prevention:

• Apply the hypothetical patch by adding a capability check.
• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php with suspicious parameters from low-privilege users.
• Restrict AJAX handlers to only necessary roles using plugins like "User Role Editor".

Indicators of Compromise (IOCs)

• Log Entries: Repeated POST requests to /wp-admin/admin-ajax.php with action=vcita_ajax_toggle_ae from the same IP or user ID.
• File Changes: Modification of WordPress options table entries like vcita_widget_*_active.
• Network Traffic: HTTP requests to admin-ajax.php with parameters widget_id and new_state from authenticated sessions with low privileges.

Detection Engineering

YARA Rule

rule Detect_vcita_AJAX_Toggle_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-13703 via AJAX toggle"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13703"
    strings:
        $ajax_action = "vcita_ajax_toggle_ae"
        $widget_param = "widget_id"
        $state_param = "new_state"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-13703 - vcita Plugin AJAX Toggle Exploitation
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized AJAX requests to toggle vcita widgets
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "action=vcita_ajax_toggle_ae"
            - "widget_id="
            - "new_state="
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13703 - vcita Plugin AJAX Toggle Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=vcita_ajax_toggle_ae"; http_client_body;
    content:"widget_id="; http_client_body;
    content:"new_state="; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Restrict Subscriber capabilities using a security plugin (e.g., restrict AJAX access).
3. Monitor logs for unauthorized AJAX requests.

Long-term Fix:

• Apply the vendor patch when available (add current_user_can('manage_options') check).
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with vcita_ajax_toggle_ae from non-admin users.

Workaround:

• Use a custom plugin or theme functions.php to add a capability check:

add_action('wp_ajax_vcita_ajax_toggle_ae', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}, 1);

Valters IT
Securing Digital Frontiers