CVE-2024-32515

Executive Summary

CVE-2024-32515 is a Missing Authorization vulnerability in the WordPress plugin Mega Addons For Elementor, developed by Qamar Sheeraz and Nasir Ahmad. The flaw affects all versions up to and including 1.8. An authenticated attacker with subscriber-level privileges or higher can exploit missing capability checks to perform unauthorized actions, such as modifying plugin settings or accessing protected data. The CVSS v3.1 base score is 5.4 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not provided a patch. This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx).

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress Plugin Directory. Users who installed the plugin directly from the directory or via automatic updates are affected. Since no patch is available, the supply chain risk is elevated: any site running the vulnerable plugin is exposed to unauthorized access. Administrators should consider removing the plugin until a fix is released.

CVSS Breakdown & Threat Level

Threat Level: Medium. Exploitation requires authentication but no special privileges beyond subscriber. The impact is limited to low confidentiality and integrity loss.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the plugin's AJAX handlers and REST endpoints. The plugin registers several actions (e.g., mega_addons_save_settings, mega_addons_get_data) without verifying that the current user has the required capabilities (e.g., manage_options or edit_posts). As a result, any authenticated user, including subscribers, can invoke these actions.

Root Cause: The plugin uses wp_ajax_* hooks but fails to call current_user_can() or wp_die() with proper capability checks. For example:

add_action('wp_ajax_mega_addons_save_settings', 'mega_addons_save_settings_callback');
function mega_addons_save_settings_callback() {
    // Missing: if (!current_user_can('manage_options')) wp_die(-1);
    update_option('mega_addons_settings', $_POST['settings']);
    wp_send_json_success();
}

This allows an attacker to:

• Modify plugin settings (integrity impact)
• Retrieve sensitive data stored in options (confidentiality impact)
• Potentially inject malicious content into the site

Vulnerable vs. Patched Code

Vulnerable Code (version 1.8):

// In mega-addons-for-elementor/admin/class-mega-addons-admin.php
add_action('wp_ajax_mega_addons_save_settings', 'mega_addons_save_settings');
function mega_addons_save_settings() {
    // No capability check
    $settings = $_POST['settings'];
    update_option('mega_addons_settings', $settings);
    wp_send_json_success();
}

Patched Code (hypothetical fix):

add_action('wp_ajax_mega_addons_save_settings', 'mega_addons_save_settings');
function mega_addons_save_settings() {
    // Proper authorization check
    if (!current_user_can('manage_options')) {
        wp_die(-1);
    }
    $settings = sanitize_text_field($_POST['settings']);
    update_option('mega_addons_settings', $settings);
    wp_send_json_success();
}

The patch adds current_user_can('manage_options') to restrict access to administrators only.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Mega Addons For Elementor <= 1.8 installed and activated.
• Valid subscriber account credentials.

Exploitation Steps:

1. Identify AJAX endpoints: Use browser developer tools or scan for admin-ajax.php actions.
2. Craft a request to modify settings:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=mega_addons_save_settings&settings[malicious]=true" \
  --cookie "wordpress_logged_in_<hash>=<subscriber_cookie>"

3. Verify exploitation: Check if the option mega_addons_settings was updated.

Note: No public exploit code exists; this is a conceptual demonstration.

Blue Team

Detection Steps:

• Monitor admin-ajax.php requests for unexpected actions (e.g., mega_addons_save_settings) from low-privilege users.
• Review WordPress options table for unauthorized changes to mega_addons_settings.
• Enable logging of AJAX requests via a plugin like "WP Security Audit Log".

Hunting Query (SQL):

SELECT * FROM wp_options WHERE option_name = 'mega_addons_settings' AND option_value NOT LIKE '%expected_value%';

Indicators of Compromise (IOCs)

• File: wp-content/plugins/mega-addons-for-elementor/admin/class-mega-addons-admin.php (version 1.8)
• Option: mega_addons_settings modified unexpectedly
• Log Entry: AJAX request to admin-ajax.php with action=mega_addons_save_settings from non-admin user
• Network: POST requests to /wp-admin/admin-ajax.php with action=mega_addons_* parameters

Detection Engineering

YARA Rule

rule CVE_2024_32515_Mega_Addons_Missing_Auth {
    meta:
        description = "Detects vulnerable Mega Addons For Elementor plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-32515"
    strings:
        $ajax_hook = "wp_ajax_mega_addons_" nocase
        $no_cap_check = "current_user_can" nocase
    condition:
        $ajax_hook and not $no_cap_check
}

Sigma Rule

title: CVE-2024-32515 - Missing Authorization in Mega Addons For Elementor
id: 8a3f7c2e-1b5d-4a9f-8c6e-0d2f3a4b5c6d
status: experimental
description: Detects unauthorized AJAX requests to vulnerable plugin endpoints
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=mega_addons_'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-32515 - Mega Addons For Elementor Missing Authorization";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=mega_addons_"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the Mega Addons For Elementor plugin until a patch is released.
2. Restrict user roles: Ensure only trusted administrators have subscriber-level access if the plugin must remain active.
3. Implement a Web Application Firewall (WAF) rule to block AJAX requests containing action=mega_addons_ from non-admin users.

Long-term Fix:

• The vendor must add capability checks (e.g., current_user_can('manage_options')) to all AJAX handlers.
• Users should monitor the plugin's page for updates and apply patches immediately.

Workaround:

• Use a plugin like "Code Snippets" to add a custom function that hooks into wp_ajax_mega_addons_* and enforces authorization.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert