CVE-2024-1436

Executive Summary

CVE-2024-1436 is a medium-severity information disclosure vulnerability affecting the WordPress plugin WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit by Wiloke. The flaw allows an unauthenticated attacker to access sensitive information, such as coupon codes or internal plugin configurations, due to improper access controls on certain endpoints. This vulnerability impacts all versions up to and including 1.0.9. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available. The EPSS score is 0.0%, indicating a low probability of active exploitation in the wild, but the risk remains for exposed WordPress sites.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The vulnerability is exploitable remotely without authentication, making it accessible to any attacker who can reach the WordPress site. The low confidentiality impact suggests that only limited sensitive data (e.g., coupon codes, non-critical settings) is exposed.

Deep Dive & Mechanics

The vulnerability resides in the MyShopKit plugin's REST API or AJAX handlers. The plugin exposes endpoints intended for frontend use (e.g., retrieving coupon popup data) but fails to enforce proper authorization checks. An unauthenticated attacker can send crafted HTTP requests to these endpoints to retrieve sensitive information, such as:

• Active coupon codes and their discount values.
• Plugin configuration details (e.g., popup timing, display rules).
• Possibly user metadata or session tokens if improperly scoped.

The root cause is a missing current_user_can() check or nonce verification in the plugin's callback functions. This is a common WordPress plugin vulnerability where developers assume that only authenticated users will access certain endpoints, but fail to enforce that assumption.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on typical WordPress security best practices.

Vulnerable Code (Example):

add_action('wp_ajax_nopriv_myshopkit_get_coupon', 'myshopkit_get_coupon');
function myshopkit_get_coupon() {
    $coupon_code = get_option('myshopkit_coupon_code');
    wp_send_json_success(['coupon' => $coupon_code]);
}

Patched Code (Hypothetical):

add_action('wp_ajax_nopriv_myshopkit_get_coupon', 'myshopkit_get_coupon');
function myshopkit_get_coupon() {
    // Add nonce verification and capability check
    if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'myshopkit_nonce')) {
        wp_send_json_error('Invalid nonce');
    }
    if (!current_user_can('edit_posts')) {
        wp_send_json_error('Unauthorized');
    }
    $coupon_code = get_option('myshopkit_coupon_code');
    wp_send_json_success(['coupon' => $coupon_code]);
}

The patched version adds a nonce check and a capability check to ensure only authorized users can access the data.

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code is available, the following is a conceptual approach:

1. Identify the vulnerable endpoint: Use a tool like Burp Suite or curl to probe common AJAX actions (e.g., admin-ajax.php?action=myshopkit_get_coupon).
2. Craft the request: Send a GET or POST request to the endpoint without any authentication headers.
3. Extract data: Parse the JSON response for sensitive information.

Example curl command:

curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
  -d "action=myshopkit_get_coupon"

Expected response (if vulnerable):

{"success":true,"data":{"coupon":"SUMMER2024"}}

Blue Team (Defense)

1. Monitor for unusual AJAX requests: Look for requests to admin-ajax.php with unknown or suspicious actions.
2. Implement Web Application Firewall (WAF) rules: Block requests to known vulnerable endpoints unless they include a valid nonce.
3. Disable the plugin: If the plugin is not critical, deactivate and delete it until a patch is available.
4. Harden WordPress: Ensure all plugins are updated, and use security plugins like Wordfence to add an extra layer of protection.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action=myshopkit_* parameters.
  • Responses containing JSON with keys like coupon, popup_settings, or smartbar_config.
• File IOCs:
  • Presence of the plugin directory: /wp-content/plugins/myshopkit/
  • Modified timestamps on plugin files (e.g., class-ajax.php).
• Log IOCs:
  • Repeated 200 responses to admin-ajax.php from the same IP without a valid nonce.
  • Access logs showing POST /wp-admin/admin-ajax.php HTTP/1.1 with action=myshopkit_get_coupon.

Detection Engineering

YARA Rule

rule CVE_2024_1436_MyShopKit_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts for CVE-2024-1436 in WordPress MyShopKit plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1436"
    strings:
        $ajax_action = "action=myshopkit_" ascii wide nocase
        $sensitive_key = "\"coupon\"" ascii wide
        $sensitive_key2 = "\"popup_settings\"" ascii wide
    condition:
        any of ($ajax_action) and any of ($sensitive_key*)
}

Sigma Rule

title: CVE-2024-1436 MyShopKit Information Disclosure Attempt
id: 8a3f7b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP requests targeting the MyShopKit plugin's AJAX endpoints without authentication.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=myshopkit_'
    condition: selection
falsepositives:
    - Legitimate plugin functionality if nonce is present (not easily detectable in logs)
level: medium

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2024-1436 MyShopKit Information Disclosure Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=myshopkit_"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2024-1436;
)

Remediation & Mitigation

1. Immediate Action: Disable and remove the MyShopKit plugin until a patch is released.
2. Vendor Contact: Reach out to Wiloke support to request a security update.
3. Workaround: If the plugin must remain active, implement a custom function in the theme's functions.php to add nonce verification to all AJAX endpoints:

   add_action('wp_ajax_nopriv_myshopkit_get_coupon', function() {
       if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'myshopkit_nonce')) {
           wp_die('Unauthorized', 403);
       }
   }, 1);
   

4. Long-term: Regularly audit all WordPress plugins for security vulnerabilities and subscribe to security advisories.

Valters IT
Securing Digital Frontiers