CVE-2024-43932

Executive Summary

CVE-2024-43932 is a Missing Authorization vulnerability in the WordPress plugin The Plus Addons for Elementor Page Builder Lite by POSIMYTH. This flaw allows unauthenticated attackers to access or modify protected resources due to insufficient permission checks on certain plugin functions. The vulnerability affects all versions up to and including 5.6.2. With a CVSS score of 6.5 (Medium), it poses a moderate risk to confidentiality and integrity, but does not impact availability. No public proof-of-concept (PoC) or exploit code has been released as of this report.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or any other web server software. The issue lies entirely within the plugin's authorization logic.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The low EPSS score (0.0%) suggests that exploitation is not currently widespread, but the lack of a patch increases the risk over time.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the plugin's REST API endpoints or AJAX handlers. The plugin registers several actions that are intended for authenticated users (e.g., saving settings, retrieving non-public data). However, due to improper capability checks, these actions are accessible to unauthenticated visitors.

Root Cause: The plugin uses wp_ajax_* hooks without verifying the user's capabilities or nonces, or it exposes REST API routes without proper permission callbacks.

Attack Vector: An attacker can send crafted HTTP requests to the vulnerable endpoints, bypassing authentication. For example, a request to /wp-json/theplus/v1/settings might allow reading or modifying plugin configuration.

Impact: Successful exploitation could lead to:

• Unauthorized access to sensitive plugin data (e.g., API keys, configuration).
• Modification of plugin settings, potentially injecting malicious content or redirecting users.
• In worst-case scenarios, privilege escalation if the plugin stores user roles or capabilities.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common fixes for CWE-862.

Vulnerable Code (v5.6.2):

add_action('wp_ajax_nopriv_theplus_save_settings', 'theplus_save_settings');
function theplus_save_settings() {
    // No capability check
    update_option('theplus_settings', $_POST['settings']);
    wp_send_json_success();
}

Patched Code (Hypothetical):

add_action('wp_ajax_theplus_save_settings', 'theplus_save_settings');
function theplus_save_settings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    check_admin_referer('theplus_settings_nonce');
    update_option('theplus_settings', $_POST['settings']);
    wp_send_json_success();
}

The fix removes the nopriv_ prefix (which allows unauthenticated access) and adds capability and nonce checks.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with The Plus Addons for Elementor Page Builder Lite <= 5.6.2 installed and activated.
• Knowledge of the vulnerable endpoint (e.g., via plugin source code analysis).

Exploitation Steps:

1. Identify vulnerable endpoints by reviewing the plugin's includes/ directory for AJAX or REST API handlers.
2. Send a crafted HTTP request to the endpoint without authentication.

Example using curl:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d 'action=theplus_save_settings&settings[malicious]=true'

If the endpoint returns a success response without requiring a nonce or capability, the vulnerability is confirmed.

Note: No public exploit code is available. The above is a generic example.

Blue Team (Defensive)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action parameters starting with theplus_ from unauthenticated users.
• Look for REST API requests to /wp-json/theplus/v1/* without valid authentication tokens.

Honeypot:

• Deploy a fake endpoint that logs all requests and alerts on unauthorized access attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action=theplus_* from unauthenticated IPs.
  • REST API calls to /wp-json/theplus/v1/* without Authorization header.
• File IOCs:
  • Modified plugin options in the wp_options table (e.g., theplus_settings).
  • Unexpected files in the uploads directory if the plugin allows file uploads.
• Log IOCs:
  • WordPress debug log entries showing theplus_* actions triggered by non-logged-in users.

Detection Engineering

YARA Rule

rule CVE_2024_43932_WordPress_Plugin {
    meta:
        description = "Detects vulnerable The Plus Addons for Elementor Page Builder Lite plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-43932"
    strings:
        $vuln_func = "wp_ajax_nopriv_theplus" nocase
        $vuln_rest = "register_rest_route" nocase
    condition:
        $vuln_func or $vuln_rest
}

Sigma Rule

title: CVE-2024-43932 - Unauthenticated AJAX Request to The Plus Addons
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated AJAX requests targeting The Plus Addons for Elementor
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=theplus_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate plugin functionality if misconfigured
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-43932 - Unauthenticated The Plus Addons AJAX"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=theplus_"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by POSIMYTH.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=theplus_* from unauthenticated users.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the official patch once released by the vendor.
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Add custom code to a site-specific plugin to enforce capability checks on all theplus_* AJAX actions.

Report generated by Valters IT DevSecOps & CTI Division