CVE-2024-30543

Executive Summary

CVE-2024-30543 is an Authorization Bypass Through User-Controlled Key vulnerability (CWE-639) affecting the Whizzy WordPress plugin by UPQODE, up to version 1.1.18. This flaw allows an unauthenticated attacker to manipulate a user-controlled key (likely a numeric ID or token) to access or modify unauthorized resources, such as private posts, user data, or plugin settings. The vulnerability is classified as Medium severity (CVSS 6.5) and currently has no known patch or public exploit code. Given the WordPress ecosystem, this could lead to unauthorized data exposure or privilege escalation if chained with other weaknesses.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and consider disabling the plugin until a patch is released. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The low complexity and no authentication requirement make this easily exploitable, though the impact is limited to partial data exposure or modification.

Deep Dive & Mechanics

The vulnerability lies in how the Whizzy plugin handles user-supplied keys (e.g., post_id, user_id, or a session token) when authorizing access to resources. The plugin likely uses a direct object reference (IDOR) pattern without proper validation, allowing an attacker to enumerate or modify values to access unintended data.

Example vulnerable endpoint:
/wp-admin/admin-ajax.php?action=whizzy_get_data&resource_id=123

By changing resource_id to another value (e.g., 124), an attacker can access data belonging to other users or private content. The plugin fails to verify that the requesting user has permission to access the resource associated with the provided key.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical vulnerable code snippet and a recommended fix.

Vulnerable Code (PHP):

function whizzy_get_data() {
    $resource_id = $_GET['resource_id'];
    $data = get_post_meta($resource_id, 'whizzy_data', true);
    wp_send_json_success($data);
}
add_action('wp_ajax_nopriv_whizzy_get_data', 'whizzy_get_data');

Patched Code (Recommended):

function whizzy_get_data() {
    $resource_id = intval($_GET['resource_id']);
    if (!current_user_can('edit_post', $resource_id)) {
        wp_die('Unauthorized', 403);
    }
    $data = get_post_meta($resource_id, 'whizzy_data', true);
    wp_send_json_success($data);
}
add_action('wp_ajax_nopriv_whizzy_get_data', 'whizzy_get_data');

The fix adds a capability check (current_user_can) to ensure the user has permission to access the resource.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Install WordPress with Whizzy plugin version 1.1.18 on a local lab.
2. Recon: Identify AJAX endpoints via admin-ajax.php with action=whizzy_*.
3. Exploit: Send a crafted request to enumerate resources:

   curl "http://target/wp-admin/admin-ajax.php?action=whizzy_get_data&resource_id=1"
   

4. Brute-force: Iterate through resource IDs to extract data:

   for i in $(seq 1 100); do
       curl -s "http://target/wp-admin/admin-ajax.php?action=whizzy_get_data&resource_id=$i"
   done
   

Blue Team (Detection & Response)

• Monitor for unusual AJAX requests to admin-ajax.php with action=whizzy_* from unauthenticated users.
• Look for sequential or high-volume resource ID enumeration patterns.
• Alert on 403 errors if a patch is applied, indicating attempted exploitation.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/admin-ajax.php with parameters action=whizzy_get_data and resource_id (or similar).
• Logs: Repeated 200 responses for different resource_id values from the same IP.
• File: No specific file changes; exploitation is memory-based.

Detection Engineering

YARA Rule

rule CVE_2024_30543_Whizzy_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2024-30543 in Whizzy plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-30543"
    strings:
        $ajax_action = "whizzy_get_data"
        $resource_param = "resource_id"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-30543 Whizzy Plugin IDOR Exploitation
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthenticated AJAX requests to Whizzy plugin endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=whizzy_get_data'
    condition: selection
falsepositives:
    - Legitimate plugin usage (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30543 Whizzy Plugin IDOR Attempt"; flow:to_server; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=whizzy_get_data"; http_uri; content:"resource_id"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the Whizzy plugin until a patch is released.
• Workaround: Implement a Web Application Firewall (WAF) rule to block requests containing action=whizzy_get_data from unauthenticated users.
• Long-term: Monitor the plugin vendor for updates and apply patches as soon as available. Consider replacing the plugin with a more secure alternative.
• Code Fix: Add proper authorization checks (e.g., current_user_can()) to all AJAX handlers.

Valters IT