CVE-2024-13740

Executive Summary

CVE-2024-13740 is an Insecure Direct Object Reference (IDOR) vulnerability discovered in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin. This flaw affects all versions up to and including 5.9.4.2. The vulnerability resides in the pm_messenger_show_messages function, which fails to properly validate a user-controlled key. This allows an authenticated attacker, with at minimum Subscriber-level access, to read private conversations between other users. The CVSS score is 4.3 (Medium), and while the EPSS score is currently 0.0%, the potential for data leakage in community-driven WordPress sites is significant. No public exploit code or patch details are available at this time.

WordPress Ecosystem Context

This vulnerability is specific to the ProfileGrid plugin for WordPress. It is not related to the core WordPress software or server infrastructure like Apache or Nginx. The attack vector is through the plugin's messaging functionality, which is a common feature in community and membership sites.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid Subscriber-level account.
• User Interaction (UI): None – The attack does not require any action from the victim.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Limited disclosure of private messages.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. While the CVSS score is moderate, the ability to read private conversations can lead to severe privacy breaches, social engineering attacks, and reputational damage for the site owner.

Deep Dive & Mechanics

The vulnerability is a classic Insecure Direct Object Reference (IDOR) in the pm_messenger_show_messages function. This function is responsible for retrieving private messages between users. The flaw lies in the lack of authorization checks on a user-controlled key (likely a conversation ID or user ID parameter). An authenticated attacker can manipulate this key to access message threads that do not belong to them.

Technical Flow:

1. An attacker logs in with a Subscriber-level account.
2. The attacker intercepts the request to pm_messenger_show_messages (e.g., via a proxy like Burp Suite).
3. The attacker modifies the conversation_id or similar parameter in the request.
4. The server returns the private messages associated with that ID, without verifying that the attacker is a participant in that conversation.

This is possible because the plugin does not implement a server-side check to ensure the requesting user is a member of the conversation. The function likely queries the database directly using the provided ID, leading to unauthorized data disclosure.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable function likely looks similar to this:

Vulnerable Code (Conceptual):

function pm_messenger_show_messages($conversation_id) {
    global $wpdb;
    $messages = $wpdb->get_results(
        $wpdb->prepare("SELECT * FROM {$wpdb->prefix}pm_messages WHERE conversation_id = %d", $conversation_id)
    );
    return $messages;
}

Patched Code (Expected):

function pm_messenger_show_messages($conversation_id) {
    global $wpdb;
    $current_user_id = get_current_user_id();
    // Verify the user is a participant in the conversation
    $is_participant = $wpdb->get_var(
        $wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}pm_conversations WHERE id = %d AND (user1_id = %d OR user2_id = %d)", $conversation_id, $current_user_id, $current_user_id)
    );
    if ($is_participant == 0) {
        wp_die('Unauthorized access');
    }
    $messages = $wpdb->get_results(
        $wpdb->prepare("SELECT * FROM {$wpdb->prefix}pm_messages WHERE conversation_id = %d", $conversation_id)
    );
    return $messages;
}

The patch would add a check to ensure the authenticated user is a participant in the requested conversation before returning the messages.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with ProfileGrid plugin version <= 5.9.4.2.
• A valid Subscriber-level account.

Steps:

1. Log in to the WordPress site as a subscriber.
2. Open the browser's developer tools (F12) and go to the Network tab.
3. Trigger the private messaging feature (e.g., send a message to another user).
4. Find the AJAX request to pm_messenger_show_messages in the network logs.
5. Copy the request as a cURL command.
6. Modify the conversation_id parameter to a different value (e.g., increment by 1).
7. Execute the modified cURL command.

Example cURL Command:

curl -X POST 'https://target-site.com/wp-admin/admin-ajax.php' \
  -H 'Cookie: wordpress_logged_in_xxx=...' \
  -d 'action=pm_messenger_show_messages&conversation_id=2'

If the response contains messages from a conversation the attacker is not part of, the vulnerability is confirmed.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual spikes in AJAX requests to admin-ajax.php with the pm_messenger_show_messages action.
• Look for requests where the conversation_id parameter is being iterated (e.g., 1, 2, 3, ...).
• Alert on multiple failed attempts to access non-existent conversations (404 errors).

Prevention:

• Apply the principle of least privilege: ensure that the pm_messenger_show_messages function checks user participation.
• Use a Web Application Firewall (WAF) to block requests with suspicious patterns.
• Implement rate limiting on AJAX endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Repeated POST requests to /wp-admin/admin-ajax.php with action=pm_messenger_show_messages.
  • Sequential conversation_id values in requests (e.g., 1, 2, 3).
  • Unauthorized access to private message data in server logs.

• File IOCs:

  • Modified or suspicious entries in the wp_pm_messages database table.
  • Unusual user activity logs in the wp_pm_conversations table.

• Behavioral IOCs:

  • A single user account accessing multiple conversation threads in a short period.
  • Subscriber-level accounts accessing conversations they were not part of.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_13740_IDOR_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2024-13740 IDOR in ProfileGrid plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13740"
    strings:
        $ajax_action = "pm_messenger_show_messages"
        $conversation_id = "conversation_id"
    condition:
        $ajax_action and $conversation_id
}

Sigma Rule

title: CVE-2024-13740 ProfileGrid IDOR Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-13740 via AJAX requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=pm_messenger_show_messages'
    condition: selection
falsepositives:
    - Legitimate use of the messaging feature
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13740 ProfileGrid IDOR Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=pm_messenger_show_messages"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the ProfileGrid plugin until a patch is released.
2. Restrict user registration to prevent new Subscriber accounts from being created.
3. Audit existing user accounts for suspicious activity.

Long-term Fix:

• The vendor must release a patched version that includes proper authorization checks in the pm_messenger_show_messages function.
• Implement server-side validation to ensure the requesting user is a participant in the conversation.

Workaround:

• If the plugin cannot be disabled, consider using a WAF rule to block requests with sequential conversation_id values.
• Monitor logs for the IOCs mentioned above.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.