CVE-2024-13873

Executive Summary

CVE-2024-13873 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress, up to and including version 2.2.8. The flaw resides in the deleteUserPhoto() function, which fails to validate a user-controlled key, allowing authenticated attackers with Subscriber-level access or higher to remove profile photos from arbitrary user accounts. The vulnerability does not delete the underlying file from the server, but it removes the association between the user and their profile photo, effectively defacing the account. With a CVSS score of 4.3 (Medium), this issue requires authentication but poses a risk to user trust and data integrity within the WordPress ecosystem.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs Subscriber-level access.
• User Interaction (UI): None (N) – No victim action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Profile photos can be removed.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. Exploitation requires authentication, but the low barrier of Subscriber access makes it a viable vector for disgruntled users or attackers who have compromised low-privilege accounts.

Deep Dive & Mechanics

The vulnerability is a classic Insecure Direct Object Reference (CWE-639) in the WordPress plugin's REST API or AJAX handler. The deleteUserPhoto() function accepts a user ID or photo ID parameter from the request without verifying that the authenticated user has permission to modify the target user's profile photo. The function likely performs a database update to unlink the photo from the user record, but does not delete the physical file.

Attack Flow:

1. Attacker authenticates as a Subscriber.
2. Attacker sends a crafted request (e.g., POST to /wp-admin/admin-ajax.php?action=delete_user_photo&user_id=123) where user_id is the victim's ID.
3. The plugin's deleteUserPhoto() function processes the request without checking if the current user owns the photo or has administrative rights.
4. The victim's profile photo is removed from their account, though the file remains on the server.

Root Cause: Missing authorization check in the deleteUserPhoto() function. The plugin relies on a user-controlled key (likely user_id or photo_id) without verifying ownership or capability.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.2.8):

function deleteUserPhoto() {
    $user_id = $_POST['user_id'];
    // Missing capability check
    update_user_meta($user_id, 'profile_photo', '');
    wp_send_json_success();
}

Patched Code (Hypothetical):

function deleteUserPhoto() {
    $user_id = $_POST['user_id'];
    // Verify current user can edit this user
    if ( ! current_user_can('edit_user', $user_id) ) {
        wp_send_json_error('Unauthorized');
        return;
    }
    update_user_meta($user_id, 'profile_photo', '');
    wp_send_json_success();
}

The patch adds a capability check using current_user_can('edit_user', $user_id) to ensure the authenticated user has permission to modify the target user's profile.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP Job Portal plugin <= 2.2.8.
• Attacker account with Subscriber role.
• Victim account with a profile photo set.

Exploitation Steps:

1. Log in as the attacker (Subscriber).
2. Obtain the victim's user ID (e.g., via user enumeration or by observing profile URLs).
3. Send the following request using cURL or a browser console:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=delete_user_photo&user_id=2' \
  --cookie 'wordpress_logged_in_xxx=attacker_session_cookie'

4. Verify the victim's profile photo is removed.

Expected Result: The victim's profile photo is unlinked from their account, displaying a default avatar.

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action delete_user_photo.
• Alert on requests where the user_id parameter differs from the authenticated user's ID.
• Review logs for unusual patterns of profile photo deletions.

Hunting:

• Query database for wp_usermeta entries where meta_key = 'profile_photo' and meta_value = '' for users who previously had a photo.
• Correlate with user activity logs to identify the deleting user.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with body containing action=delete_user_photo and a user_id parameter.
• Host: WordPress database entries in wp_usermeta where meta_key = 'profile_photo' and meta_value = '' for users who previously had a photo.
• Log: WordPress debug log entries showing deleteUserPhoto function calls with mismatched user IDs.

Detection Engineering

YARA Rule

rule CVE_2024_13873_WP_Job_Portal_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2024-13873 in WP Job Portal plugin"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13873"
    strings:
        $ajax_action = "action=delete_user_photo"
        $user_id_param = "user_id="
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-13873 WP Job Portal IDOR Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests targeting admin-ajax.php with delete_user_photo action
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "admin-ajax.php"
        cs-uri-query|contains|all:
            - "action=delete_user_photo"
            - "user_id="
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13873 WP Job Portal IDOR Exploitation";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"admin-ajax.php";
    http_uri;
    content:"action=delete_user_photo";
    http_client_body;
    content:"user_id=";
    http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-13873;
    classtype:attempted-user;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: If a patched version becomes available, update WP Job Portal immediately.
2. Disable Plugin: If no patch is available, consider disabling the plugin until a fix is released.
3. Restrict Subscriber Access: Limit Subscriber capabilities via a security plugin (e.g., restrict AJAX actions).

Long-term Fix:

• Implement proper authorization checks in deleteUserPhoto() using current_user_can() or wp_verify_nonce().
• Validate that the authenticated user owns the photo or has edit_users capability.

Workaround:

• Use a Web Application Firewall (WAF) to block requests containing action=delete_user_photo from non-admin users.

Valters IT
Securing WordPress Ecosystems