CVE-2024-1390

Executive Summary

CVE-2024-1390 is a Missing Authorization vulnerability in the Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction WordPress plugin. This flaw allows authenticated attackers with subscriber-level access or higher to create pricing tables without proper capability checks. The vulnerability affects all versions up to and including 2.11.1. While the CVSS score is 4.3 (Medium), the risk is elevated in multi-tenant or membership-based WordPress sites where subscriber accounts are common. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the lack of a patch makes it a persistent threat.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or PHP core. The plugin is widely used for membership management, making it a target for privilege escalation and content manipulation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (Pricing table creation)
• Availability Impact: None

Threat Level: Medium. The vulnerability allows unauthorized creation of pricing tables, which could lead to financial manipulation or confusion in membership tiers. However, it does not directly lead to data exfiltration or full site compromise.

Deep Dive & Mechanics

The vulnerability resides in the creating_pricing_table_page function within the plugin. This function is responsible for rendering the pricing table creation interface. The plugin fails to perform a capability check (e.g., current_user_can('manage_options')) before allowing the action. As a result, any authenticated user with subscriber-level access or higher can trigger this function and create new pricing tables.

Root Cause: Missing capability check in the creating_pricing_table_page function. The function is hooked to an admin AJAX action or page load without verifying the user's role.

Attack Flow:

1. Attacker logs in as a subscriber (or higher).
2. Attacker crafts a request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=create_pricing_table).
3. The plugin processes the request and creates a new pricing table without checking if the user has administrative privileges.
4. The attacker can then manipulate pricing tiers, potentially offering discounts or creating fake membership levels.

Impact: Unauthorized pricing table creation can lead to:

• Financial loss through manipulated subscription prices.
• Reputation damage if fake tiers are displayed.
• Potential for further exploitation if pricing tables are used in other vulnerable functions.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.11.1):

function creating_pricing_table_page() {
    // No capability check
    // Process and create pricing table
    $pricing_table = new PricingTable();
    $pricing_table->create($_POST);
}

Patched Code (Hypothetical):

function creating_pricing_table_page() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // Process and create pricing table
    $pricing_table = new PricingTable();
    $pricing_table->create($_POST);
}

Note: No official patch has been released as of this analysis. The patched code above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Paid Membership Subscriptions plugin <= 2.11.1.
• Valid subscriber account credentials.

Exploit Steps:

1. Log in as a subscriber.
2. Intercept a request to the pricing table creation endpoint.
3. Send a crafted POST request to /wp-admin/admin-ajax.php with action create_pricing_table and required parameters.

Example cURL Command:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -H 'Cookie: wordpress_logged_in_xxx=...' \
  -d 'action=create_pricing_table&name=Malicious+Table&price=0.00'

Expected Outcome: A new pricing table is created with the attacker's specified values.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual pricing table creation events in WordPress logs.
2. Alert on subscriber-level users accessing admin AJAX actions related to pricing tables.
3. Review user role assignments and audit for unauthorized privilege escalation.

Response:

• Immediately disable the plugin if no patch is available.
• Remove any unauthorized pricing tables.
• Reset compromised subscriber accounts.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/paid-membership-subscriptions/ (entire plugin directory)
• Database: New entries in wp_pms_pricing_tables table with unexpected values.
• Logs: AJAX requests to admin-ajax.php with action create_pricing_table from subscriber-level users.
• Network: POST requests to /wp-admin/admin-ajax.php with parameters containing action=create_pricing_table.

Detection Engineering

YARA Rule

rule CVE_2024_1390_WordPress_Plugin
{
    meta:
        description = "Detects vulnerable Paid Membership Subscriptions plugin files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1390"
    strings:
        $func = "creating_pricing_table_page"
        $no_check = "current_user_can" nocase
    condition:
        $func and not $no_check
}

Sigma Rule

title: CVE-2024-1390 - Unauthorized Pricing Table Creation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit missing authorization in Paid Membership Subscriptions plugin
author: Valters IT
logsource:
    category: web
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin-ajax.php'
        http.body: 'action=create_pricing_table'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1390 - Unauthorized Pricing Table Creation"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=create_pricing_table"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=create_pricing_table from non-admin users.
3. Audit user roles and remove any unnecessary subscriber accounts.

Long-term Fix:

• Apply the hypothetical patch by adding current_user_can('manage_options') check to the creating_pricing_table_page function.
• Monitor the plugin vendor for an official patch and update immediately.

Workaround:

• Use a WordPress security plugin to enforce capability checks on AJAX actions.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert