CVE-2024-37202

Executive Summary

CVE-2024-37202 is a Missing Authorization vulnerability in the WordPress plugin Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter, affecting versions up to and including 1.222.17. This flaw allows unauthenticated attackers to bypass authorization checks, potentially enabling unauthorized modifications to WooCommerce add-to-cart button configurations. The vulnerability resides in the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates from the vendor (Binarycarpenter) and apply patches as soon as they become available. Since the patch status is currently unknown, supply chain risk is elevated.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the low integrity impact and lack of confidentiality or availability impact. However, the ease of exploitation (no authentication required) increases the risk for WooCommerce sites.

Deep Dive & Mechanics

The vulnerability is a Missing Authorization (CWE-862) issue in the plugin's AJAX handler for custom add-to-cart button configurations. The plugin fails to properly verify user permissions before processing requests to modify button settings. This allows any unauthenticated user to send crafted HTTP requests to the WordPress AJAX endpoint, potentially altering button behavior, redirect URLs, or other configuration parameters.

The flaw likely exists in the wp_ajax_* or wp_ajax_nopriv_* hooks where the plugin registers its AJAX actions. Without a current_user_can() check, the plugin processes requests from any visitor.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is:

Vulnerable (<= 1.222.17):

add_action('wp_ajax_nopriv_update_cart_button', 'update_cart_button_handler');
function update_cart_button_handler() {
    // No authorization check
    $button_settings = $_POST['button_settings'];
    update_option('custom_cart_button_settings', $button_settings);
    wp_die();
}

Patched (hypothetical):

add_action('wp_ajax_update_cart_button', 'update_cart_button_handler');
add_action('wp_ajax_nopriv_update_cart_button', 'update_cart_button_handler');
function update_cart_button_handler() {
    if (!current_user_can('manage_woocommerce')) {
        wp_die('Unauthorized', 403);
    }
    $button_settings = $_POST['button_settings'];
    update_option('custom_cart_button_settings', $button_settings);
    wp_die();
}

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify WordPress sites using the plugin via Shodan dorks or Google dorking.
2. Exploitation: Send a crafted POST request to the AJAX endpoint:

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
     -d "action=update_cart_button&button_settings[redirect_url]=https://evil.com"
   

3. Post-Exploitation: Modify button settings to redirect users to a malicious site or alter the add-to-cart behavior.

Blue Team

1. Detection: Monitor for unusual AJAX requests to admin-ajax.php with the action parameter containing plugin-specific actions (e.g., update_cart_button).
2. Honeypot: Deploy a fake WooCommerce site with the vulnerable plugin and log all AJAX requests.
3. Mitigation: Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to plugin-specific AJAX actions.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=update_cart_button or similar plugin-specific actions.
• File: Modified wp_options table entries containing custom_cart_button_settings.
• Log: WordPress debug log entries showing unauthorized AJAX requests.

Detection Engineering

YARA Rule

rule CVE_2024_37202_WordPress_Plugin {
    meta:
        description = "Detects exploitation attempts for CVE-2024-37202 in WordPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-37202"
    strings:
        $ajax_action = "update_cart_button" nocase
        $plugin_path = "custom-add-to-cart-button-for-woocommerce" nocase
    condition:
        $ajax_action or $plugin_path
}

Sigma Rule

title: CVE-2024-37202 WordPress Plugin Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts for CVE-2024-37202
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=update_cart_button'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37202 WordPress Plugin Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=update_cart_button"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the plugin until a patch is released.
2. Short-term: Implement a WAF rule to block unauthenticated AJAX requests to plugin-specific actions.
3. Long-term: Monitor the vendor's website for updates and apply patches as soon as they become available.
4. Alternative: Consider using a different WooCommerce add-to-cart button plugin with proper authorization checks.

Valters IT Signature:
"Securing digital frontiers, one vulnerability at a time."