CVE-2024-3627

Executive Summary

CVE-2024-3627 is a Missing Authorization vulnerability in the Wheel of Life: Coaching and Assessment Tool for Life Coach WordPress plugin. This flaw allows authenticated attackers with subscriber-level access or higher to delete arbitrary posts and modify plugin settings without proper capability checks. The vulnerability resides in the AjaxFunctions.php file, which handles AJAX requests without verifying user permissions. This can lead to unauthorized data loss and configuration tampering, impacting the integrity and availability of the WordPress site.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect the core WordPress software or server-level components like Apache or Nginx. The attack vector is through the plugin's AJAX handlers, which are accessible to any authenticated user.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the vulnerability requires authentication, the low barrier of entry (subscriber-level) and the ability to delete posts and modify settings make it a significant risk for sites with untrusted users.

Deep Dive & Mechanics

The vulnerability is caused by missing capability checks in several AJAX handler functions within the AjaxFunctions.php file. The plugin registers AJAX actions for both authenticated and unauthenticated users but fails to verify that the user has the necessary permissions (e.g., edit_posts, manage_options) before executing sensitive operations.

Affected Functions (likely):

• delete_post - Deletes a post by ID.
• update_settings - Modifies plugin settings.

Attack Flow:

1. An attacker registers or obtains a subscriber-level account on the WordPress site.
2. The attacker sends a crafted AJAX request to the WordPress admin-ajax.php endpoint with the appropriate action parameter (e.g., wheel_of_life_delete_post).
3. The plugin processes the request without checking if the user has the delete_posts capability.
4. The attacker can delete any post (including pages, custom post types) or modify plugin settings.

Root Cause: The plugin uses wp_ajax_* hooks but does not call current_user_can() or wp_verify_nonce() to validate the user's permissions.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is as follows:

Vulnerable Code (AjaxFunctions.php):

add_action('wp_ajax_wheel_of_life_delete_post', 'wheel_of_life_delete_post');
function wheel_of_life_delete_post() {
    $post_id = intval($_POST['post_id']);
    wp_delete_post($post_id, true);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_wheel_of_life_delete_post', 'wheel_of_life_delete_post');
function wheel_of_life_delete_post() {
    if (!current_user_can('delete_posts')) {
        wp_die('Unauthorized', 403);
    }
    if (!wp_verify_nonce($_POST['_wpnonce'], 'wheel_of_life_delete_post')) {
        wp_die('Invalid nonce', 403);
    }
    $post_id = intval($_POST['post_id']);
    wp_delete_post($post_id, true);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the vulnerable plugin installed (version <= 1.1.7).
• A subscriber-level account (username: attacker, password: attacker123).

Exploitation Steps:

1. Log in as the subscriber and obtain the WordPress nonce (if required) or directly craft the AJAX request.
2. Send a POST request to https://target.com/wp-admin/admin-ajax.php with the following parameters:
   • action: wheel_of_life_delete_post
   • post_id: 123 (ID of the target post)
   • _wpnonce: (if required, obtain from the page source)

Example cURL Command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=wheel_of_life_delete_post&post_id=123&_wpnonce=abc123" \
  --cookie "wordpress_logged_in_xxx=attacker_session_cookie"

Expected Outcome: The post with ID 123 is permanently deleted.

Blue Team (Detection & Prevention)

Detection:

• Monitor AJAX requests to admin-ajax.php with suspicious actions like wheel_of_life_delete_post or wheel_of_life_update_settings.
• Look for requests from low-privilege users (subscriber) performing administrative actions.

Prevention:

• Immediately disable or uninstall the plugin until a patch is released.
• Use a Web Application Firewall (WAF) to block AJAX requests from subscribers that target plugin-specific actions.
• Implement a custom capability check via a WordPress mu-plugin:

add_action('wp_ajax_wheel_of_life_delete_post', function() {
    if (!current_user_can('delete_posts')) {
        wp_die('Unauthorized', 403);
    }
}, 1);

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=wheel_of_life_delete_post or action=wheel_of_life_update_settings.
  • User agents from automated tools (e.g., python-requests, curl).
• File IOCs:
  • Modified wp-config.php or plugin settings.
  • Deleted posts or pages without corresponding log entries.
• Log IOCs:
  • WordPress debug log entries showing wp_die calls or AJAX errors.
  • Web server access logs with 200 responses to admin-ajax.php from subscriber roles.

Detection Engineering

YARA Rule

rule CVE_2024_3627_Wheel_of_Life_Missing_Auth {
    meta:
        description = "Detects vulnerable Wheel of Life plugin files with missing capability checks"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3627"
    strings:
        $ajax_action = /add_action\s*\(\s*['\"]wp_ajax_wheel_of_life_/
        $missing_cap = /wp_delete_post|update_option/
        $no_cap_check = !/current_user_can/
    condition:
        $ajax_action and $missing_cap and $no_cap_check
}

Sigma Rule

title: CVE-2024-3627 Wheel of Life Plugin AJAX Abuse
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized AJAX requests to delete posts or modify settings via the Wheel of Life plugin
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=wheel_of_life_delete_post'
            - 'action=wheel_of_life_update_settings'
    condition: selection
falsepositives:
    - Legitimate admin users performing these actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-3627 Wheel of Life Plugin AJAX Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=wheel_of_life_delete_post"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Audit user roles and remove any untrusted subscriber accounts.
3. Restore deleted posts from backups if affected.

Long-term Fix:

• The vendor must release a patched version that adds capability checks (current_user_can()) and nonce verification to all AJAX handlers.
• Implement a custom patch as shown in the "Vulnerable vs. Patched Code" section.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to block AJAX requests from low-privilege users.
• Add the following code to a custom mu-plugin to enforce capability checks:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX) {
        $action = $_REQUEST['action'] ?? '';
        if (strpos($action, 'wheel_of_life_') === 0) {
            if (!current_user_can('edit_posts')) {
                wp_die('Unauthorized', 403);
            }
        }
    }
});

Valters IT
Securing Digital Ecosystems