CVE-2024-4274

Executive Summary

CVE-2024-4274 is a vulnerability in the Essential Real Estate WordPress plugin (versions up to and including 4.4.2) that allows authenticated attackers with subscriber-level access or higher to delete arbitrary attachments from the WordPress media library. The flaw resides in the remove_property_attachment_ajax() function, which lacks proper authorization and nonce validation checks. This is a classic Missing Authorization (CWE-862) issue within the WordPress ecosystem, enabling a low-privileged user to cause unauthorized data loss by deleting attachments that do not belong to them.

The vulnerability has a CVSS score of 4.3 (Medium), with a low attack complexity and no user interaction required. The EPSS score is 0.0%, indicating a low probability of active exploitation in the wild at this time. No public proof-of-concept (PoC) code or exploit-db entry is available, but the attack vector is straightforward for an authenticated attacker.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since the plugin is not an NPM, PyPI, Go, or Ruby package, supply chain risks are limited to the plugin's update mechanism. Users should monitor the plugin's page for a patched version and apply updates immediately when available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can exploit this remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Requires subscriber-level authentication.
• User Interaction (UI): None (N) – No victim action needed.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Attacker can delete attachments, affecting data integrity.
• Availability (A): Low (L) – Deletion of attachments can impact site functionality.

Threat Level: Medium. While the CVSS score is 4.3, the ability to delete arbitrary attachments (including critical media files) could lead to significant data loss and service disruption. The low privilege requirement makes this a viable attack vector for malicious insiders or compromised accounts.

Deep Dive & Mechanics

The vulnerability is located in the remove_property_attachment_ajax() function within the Essential Real Estate plugin. This function is intended to allow property owners or administrators to delete attachments associated with a property listing. However, the function fails to verify that the current user has the proper capabilities (e.g., edit_post or delete_posts) and does not check if the attachment belongs to the user's own property.

Attack Flow:

1. An authenticated user with subscriber-level privileges logs into the WordPress site.
2. The user sends a POST request to the WordPress AJAX endpoint wp_ajax_remove_property_attachment with the attachment_id parameter.
3. The vulnerable function remove_property_attachment_ajax() processes the request without verifying user permissions or ownership.
4. The function calls wp_delete_attachment() on the provided attachment ID, permanently deleting the file from the server and the database.

Key Weaknesses:

• Missing Authorization: No capability check (e.g., current_user_can('delete_posts')) is performed.
• No Nonce Validation: The AJAX action lacks a nonce check, making it susceptible to CSRF-like attacks (though authentication is still required).
• No Ownership Check: The function does not verify that the attachment belongs to a property owned by the current user.

Vulnerable vs. Patched Code

Vulnerable Code (version 4.4.2):

function remove_property_attachment_ajax() {
    $attachment_id = intval($_POST['attachment_id']);
    if ($attachment_id > 0) {
        wp_delete_attachment($attachment_id, true);
        echo 'success';
    }
    wp_die();
}
add_action('wp_ajax_remove_property_attachment', 'remove_property_attachment_ajax');

Patched Code (hypothetical fix):

function remove_property_attachment_ajax() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'remove_property_attachment_nonce')) {
        wp_die('Security check failed.');
    }
    
    // Check user capabilities
    if (!current_user_can('delete_posts')) {
        wp_die('You do not have permission to delete attachments.');
    }
    
    $attachment_id = intval($_POST['attachment_id']);
    if ($attachment_id > 0) {
        // Verify attachment ownership (e.g., check post author)
        $attachment = get_post($attachment_id);
        if ($attachment && $attachment->post_author == get_current_user_id()) {
            wp_delete_attachment($attachment_id, true);
            echo 'success';
        } else {
            wp_die('You can only delete your own attachments.');
        }
    }
    wp_die();
}
add_action('wp_ajax_remove_property_attachment', 'remove_property_attachment_ajax');

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the Essential Real Estate plugin version <= 4.4.2.
• An authenticated user account with subscriber-level privileges or higher.

Exploitation Steps:

1. Log in as a subscriber.
2. Obtain a valid attachment ID (e.g., by browsing the media library or guessing).
3. Send a crafted AJAX request to delete the attachment.

Proof-of-Concept (PoC) using cURL:

curl -X POST \
  'http://target-site/wp-admin/admin-ajax.php' \
  -H 'Cookie: wordpress_logged_in_<hash>=<session_cookie>' \
  -d 'action=remove_property_attachment&attachment_id=123'

Expected Output:

• The server responds with success if the attachment ID exists.
• The attachment is permanently deleted from the media library.

Blue Team (Detection & Prevention)

Detection:

• Monitor AJAX requests to admin-ajax.php with the action=remove_property_attachment parameter.
• Alert on requests from low-privileged users (subscriber, contributor) that result in successful attachment deletion.
• Log all wp_delete_attachment() calls and correlate with user roles.

Prevention:

• Apply the hypothetical patch above (add nonce, capability, and ownership checks).
• Use a Web Application Firewall (WAF) to block suspicious AJAX requests.
• Restrict subscriber-level users from accessing the media library via role management plugins.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=remove_property_attachment and attachment_id=<integer>.
  • Repeated requests with sequential or random attachment IDs from the same user session.

• File System IOCs:

  • Unexpected deletion of media files from /wp-content/uploads/ directory.
  • Missing attachment entries in the wp_posts table (post_type = 'attachment').

• Log IOCs:

  • WordPress debug log entries showing wp_delete_attachment() calls without corresponding edit_post capability checks.
  • Server access logs showing AJAX requests from authenticated users with subscriber role.

Detection Engineering

YARA Rule

rule CVE_2024_4274_WordPress_Essential_Real_Estate {
    meta:
        description = "Detects exploitation attempts of CVE-2024-4274 in Essential Real Estate plugin"
        author = "Valters IT"
        date = "2024-07-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-4274"
        severity = "medium"
    strings:
        $ajax_action = "remove_property_attachment"
        $attachment_id = "attachment_id"
        $wp_delete = "wp_delete_attachment"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-4274 - Essential Real Estate Attachment Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized attachment deletion via the Essential Real Estate plugin
author: Valters IT
date: 2024-07-27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=remove_property_attachment'
        cs-uri-query|contains: 'attachment_id='
    condition: selection
falsepositives:
    - Legitimate property management actions by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-4274 - Essential Real Estate Attachment Deletion Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=remove_property_attachment"; http_client_body;
    content:"attachment_id="; http_client_body;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
    reference:cve,2024-4274;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to business operations until a patch is released.
2. Restrict user roles – Remove subscriber-level access to the site if possible, or use a plugin like "User Role Editor" to deny delete_posts capability to subscribers.
3. Monitor logs – Review server and WordPress logs for any suspicious AJAX requests matching the IOCs.

Long-Term Fix:

• Apply the patched code provided in the "Vulnerable vs. Patched Code" section once the vendor releases an update.
• Implement a Web Application Firewall (WAF) rule to block requests with action=remove_property_attachment from non-admin users.
• Conduct a security audit of all WordPress plugins to identify similar authorization flaws.

Workaround:

• Add the following code to the theme's functions.php file to block the vulnerable AJAX action for non-admin users:

add_action('wp_ajax_remove_property_attachment', function() {
    if (!current_user_can('administrator')) {
        wp_die('Access denied.');
    }
}, 1);

Valters IT
Securing Digital Frontiers