CVE-2024-3606

Executive Summary

CVE-2024-3606 is a Missing Authorization vulnerability in the ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress. The flaw resides in the pm_upload_cover_image function, which fails to perform a capability check before processing attachment deletion requests. This allows authenticated attackers with subscriber-level access or higher to delete arbitrary attachments (e.g., user-uploaded images, cover photos) without proper authorization.

The vulnerability affects all versions up to and including 5.8.3. As of this report, no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks against WordPress sites using this plugin.

WordPress Ecosystem Context: This vulnerability is specific to the ProfileGrid plugin and does not affect the core WordPress application or server software like Apache/Nginx.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber+)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (Unauthorized deletion of attachments)
• Availability Impact: None

Threat Level: Medium. While the impact is limited to integrity (deletion of non-critical data), the low attack complexity and low privileges required make it a viable vector for defacement or data loss in community-driven sites.

Deep Dive & Mechanics

The vulnerability exists in the pm_upload_cover_image AJAX handler. This function is intended to allow users to upload or delete their own cover images. However, the code does not verify that the current user has the edit_post or delete_post capability for the attachment being deleted. An attacker can send a crafted POST request to the WordPress admin-ajax.php endpoint with the action pm_upload_cover_image and a parameter specifying the attachment ID to delete.

Root Cause: Missing capability check (CWE-862) in the pm_upload_cover_image function. The function only checks if the user is logged in (subscriber or higher) but does not validate ownership or permissions for the attachment.

Attack Flow:

1. Attacker authenticates as a subscriber (or higher).
2. Attacker sends a POST request to /wp-admin/admin-ajax.php with:
   • action=pm_upload_cover_image
   • delete_attachment=1
   • attachment_id=<target_attachment_id>
3. The plugin deletes the attachment without verifying if the attacker owns it or has permission.

Vulnerable vs. Patched Code

Vulnerable Code (ProfileGrid <= 5.8.3):

function pm_upload_cover_image() {
    // No capability check
    if ( isset($_POST['delete_attachment']) && $_POST['delete_attachment'] == 1 ) {
        $attachment_id = intval($_POST['attachment_id']);
        wp_delete_attachment($attachment_id, true);
    }
    // ... rest of function
}
add_action('wp_ajax_pm_upload_cover_image', 'pm_upload_cover_image');

Patched Code (Hypothetical fix):

function pm_upload_cover_image() {
    // Add capability check
    if ( isset($_POST['delete_attachment']) && $_POST['delete_attachment'] == 1 ) {
        $attachment_id = intval($_POST['attachment_id']);
        // Verify user owns the attachment or has edit_others_posts capability
        if ( current_user_can('edit_post', $attachment_id) || get_post_field('post_author', $attachment_id) == get_current_user_id() ) {
            wp_delete_attachment($attachment_id, true);
        } else {
            wp_die('Unauthorized');
        }
    }
    // ... rest of function
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with ProfileGrid plugin <= 5.8.3
• Valid subscriber account credentials

Exploitation Steps:

1. Log in as a subscriber.
2. Obtain a valid nonce for the pm_upload_cover_image action (if required; the vulnerable code may not enforce nonces).
3. Send a POST request to delete an arbitrary attachment:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=pm_upload_cover_image&delete_attachment=1&attachment_id=123" \
  --cookie "wordpress_logged_in_<hash>=<session_cookie>"

Expected Result: The attachment with ID 123 is deleted without authorization.

Blue Team

Detection Steps:

1. Monitor WordPress admin-ajax.php requests for the pm_upload_cover_image action with delete_attachment=1.
2. Alert on any deletion of attachments where the requesting user is not the author of the attachment.
3. Review server logs for unusual patterns of attachment deletions by low-privilege users.

Mitigation (Temporary):

• Disable the ProfileGrid plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=pm_upload_cover_image and delete_attachment=1 from non-admin users.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with body containing action=pm_upload_cover_image&delete_attachment=1&attachment_id=
• File System:
  • Missing attachment files in /wp-content/uploads/ that were previously present.
• Logs:
  • WordPress debug log entries showing wp_delete_attachment calls from unexpected user roles.
  • Apache/Nginx access logs with POST /wp-admin/admin-ajax.php and HTTP 200 responses for subscriber sessions.

Detection Engineering

YARA Rule

rule CVE_2024_3606_ProfileGrid_Delete_Attachment {
    meta:
        description = "Detects exploitation attempts of CVE-2024-3606 in ProfileGrid plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-3606"
    strings:
        $ajax_action = "pm_upload_cover_image"
        $delete_param = "delete_attachment=1"
        $attachment_id = "attachment_id="
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-3606 ProfileGrid Unauthorized Attachment Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to WordPress admin-ajax.php with ProfileGrid delete attachment parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query: 
            - "/wp-admin/admin-ajax.php"
        cs-body: 
            - "action=pm_upload_cover_image"
            - "delete_attachment=1"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-3606 ProfileGrid Unauthorized Attachment Deletion Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=pm_upload_cover_image"; http_client_body;
    content:"delete_attachment=1"; http_client_body;
    content:"attachment_id="; http_client_body;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the ProfileGrid plugin until a patched version is released.
2. Implement a WAF rule to block the specific POST parameters.
3. Audit user roles and remove any unnecessary subscriber accounts.

Long-term Fix:

• Apply the official patch from the vendor when available (check ProfileGrid changelog).
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Add a custom capability check via a WordPress plugin or theme functions.php:

add_action('wp_ajax_pm_upload_cover_image', 'custom_pm_upload_cover_image', 1);
function custom_pm_upload_cover_image() {
    if ( isset($_POST['delete_attachment']) && $_POST['delete_attachment'] == 1 ) {
        $attachment_id = intval($_POST['attachment_id']);
        if ( ! current_user_can('edit_post', $attachment_id) ) {
            wp_die('Unauthorized');
        }
    }
}

Valters IT
Securing Digital Frontiers