CVE-2024-13715

Executive Summary

CVE-2024-13715 is a vulnerability in the WordPress plugin zStore Manager Basic, affecting all versions up to and including 3.311. The issue lies in the zstore_clear_cache() function, which lacks a capability check, allowing authenticated attackers with Subscriber-level access or higher to clear the plugin's cache. This unauthorized loss of data can disrupt site performance and potentially lead to denial of service if the cache is critical for operation. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates from the vendor and apply patches as soon as they become available. The plugin is not part of a standard package manager like NPM or PyPI, but its distribution through the WordPress ecosystem introduces supply chain risks if the plugin is compromised.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: Low

The threat level is considered Medium due to the low privileges required and the potential for cache clearing, which can degrade site performance. However, the lack of public exploits and low EPSS score reduces immediate risk.

Deep Dive & Mechanics

The vulnerability exists in the zstore_clear_cache() function within the zStore Manager Basic plugin. This function is intended to clear the plugin's cache, but it is registered via WordPress AJAX hooks without a proper capability check. In WordPress, AJAX actions should verify user capabilities (e.g., manage_options) before executing sensitive operations. The missing check allows any authenticated user, including Subscribers, to trigger the cache clearing.

The function likely uses wp_ajax_ and wp_ajax_nopriv_ hooks, but the nopriv variant is not present, meaning only authenticated users can trigger it. However, the capability check is absent, so any authenticated user can call the function.

Attack Flow:

1. Attacker authenticates as a Subscriber (or higher role).
2. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=zstore_clear_cache.
3. The plugin executes the cache clearing routine without verifying if the user has administrative privileges.
4. The cache is cleared, potentially causing performance degradation or temporary data loss.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be:

Vulnerable Code (zstore-manager-basic.php):

add_action('wp_ajax_zstore_clear_cache', 'zstore_clear_cache');
function zstore_clear_cache() {
    // Clear cache logic
    delete_transient('zstore_cache_data');
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_zstore_clear_cache', 'zstore_clear_cache');
function zstore_clear_cache() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // Clear cache logic
    delete_transient('zstore_cache_data');
    wp_die();
}

The patch adds a capability check using current_user_can('manage_options') to restrict cache clearing to administrators only.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with zStore Manager Basic <= 3.311 installed.
• Valid user credentials with Subscriber role or higher.

Exploitation Steps:

1. Log in as a Subscriber.
2. Use a tool like cURL or Burp Suite to send a POST request:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
        -d "action=zstore_clear_cache" \
        --cookie "wordpress_logged_in_xxx=..."
   

3. The plugin's cache is cleared, potentially causing performance issues.

Note: No public exploit code is available, but the above demonstrates the attack.

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action=zstore_clear_cache from non-admin users.
• Alert on repeated cache clearing events within a short timeframe.

Hunting:

• Search logs for action=zstore_clear_cache in POST requests.
• Check for unusual cache clearing patterns from low-privilege users.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with parameter action=zstore_clear_cache.
• Logs: WordPress debug logs showing cache clearing events from unexpected user roles.
• System: Decreased site performance due to cache being cleared repeatedly.

Detection Engineering

YARA Rule

rule Detect_zStore_Cache_Clear_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2024-13715 by clearing zStore cache"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-13715"
    strings:
        $ajax_action = "action=zstore_clear_cache"
        $wp_ajax = "admin-ajax.php"
    condition:
        $ajax_action and $wp_ajax
}

Sigma Rule

title: zStore Manager Basic Cache Clear Exploit
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthorized cache clearing attempts via CVE-2024-13715
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=zstore_clear_cache'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13715 zStore Cache Clear Attempt"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=zstore_clear_cache"; http_client_body; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, or restrict access via .htaccess:

   <Files "admin-ajax.php">
       Require user admin
   </Files>
   

2. Monitor for unauthorized cache clearing attempts using the provided detection rules.

Long-term Fix:

• Apply a patch from the vendor when available.
• Implement a Web Application Firewall (WAF) rule to block action=zstore_clear_cache from non-admin users.
• Update the plugin code to include capability checks as shown in the patched code example.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this vulnerability.

Valters IT