CVE-2024-4445

Executive Summary

CVE-2024-4445 is a missing authorization vulnerability in the WordPress plugin WP Compress – Image Optimizer [All-In-One], affecting versions up to and including 6.20.01. This flaw allows authenticated attackers with subscriber-level permissions or higher to modify plugin settings in multisite environments without proper capability checks. The vulnerability can be leveraged to store cross-site scripting (XSS) payloads, leading to potential privilege escalation or data theft. The CVSS score is 6.5 (Medium), and no public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated subscriber-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H) – allows unauthorized modification of plugin settings
• Availability Impact: None (A:N)

Threat Level: Medium. While the attack requires authentication, the low privilege requirement and potential for stored XSS make this a significant risk in multisite environments.

Deep Dive & Mechanics

The vulnerability resides in the WP Compress plugin’s administrative functions that handle plugin settings. In versions up to 6.20.01, several functions lack proper capability checks, allowing any authenticated user (including subscribers) to modify plugin settings via AJAX requests. In a multisite WordPress installation, this can lead to stored XSS if an attacker injects malicious JavaScript into settings fields that are later rendered in the admin dashboard.

The missing capability check means that functions like wpc_save_settings, wpc_update_option, or similar (exact function names not publicly disclosed) do not verify the user’s role before processing requests. An attacker can craft a POST request to the vulnerable endpoint with malicious payloads, bypassing intended access controls.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the plugin’s main PHP files. A typical vulnerable pattern would be:

Vulnerable Code (example):

add_action('wp_ajax_wpc_save_settings', 'wpc_save_settings_callback');
function wpc_save_settings_callback() {
    // No capability check
    update_option('wpc_settings', $_POST['settings']);
}

Patched Code (expected):

add_action('wp_ajax_wpc_save_settings', 'wpc_save_settings_callback');
function wpc_save_settings_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    update_option('wpc_settings', $_POST['settings']);
}

The patch would add a current_user_can('manage_options') check to ensure only administrators can modify settings.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress multisite installation with WP Compress plugin version <= 6.20.01
• A subscriber-level account (or higher)

Exploitation Steps:

1. Log in as a subscriber.
2. Identify the AJAX action used for saving settings (e.g., wpc_save_settings).
3. Craft a POST request to /wp-admin/admin-ajax.php with the action parameter and malicious payload.
4. Example using cURL:

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
     -d "action=wpc_save_settings&settings[option_name]=<script>alert('XSS')</script>" \
     --cookie "wordpress_logged_in_xxx=..."
   

5. The malicious setting is stored and executed when an admin views the settings page.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php from low-privilege users (subscriber, contributor).
2. Look for unexpected action parameters related to WP Compress (e.g., wpc_save_settings, wpc_update_option).
3. Inspect plugin settings for unexpected HTML/JavaScript content.
4. Review WordPress user roles and ensure least privilege.

Honeypot Setup:

• Deploy a fake WP Compress settings page that logs all access attempts.
• Alert on any modification to plugin options by non-admin users.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action parameters like wpc_save_settings from low-privilege users.
  • Unusual settings parameters containing <script> tags or base64-encoded payloads.

• File IOCs:

  • Modified entries in wp_options table with key wpc_settings containing XSS payloads.
  • Unexpected files in /wp-content/plugins/wp-compress-image-optimizer/ (if exploited for file upload).

• Log IOCs:

  • WordPress debug log entries showing wp_ajax_wpc_save_settings calls from unexpected user roles.
  • Web server logs with 200 responses to admin-ajax.php from subscriber IPs.

Detection Engineering

YARA Rule

rule CVE_2024_4445_WP_Compress_Missing_Auth {
    meta:
        description = "Detects missing capability check in WP Compress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-4445"
    strings:
        $func1 = "wpc_save_settings" ascii wide nocase
        $func2 = "wpc_update_option" ascii wide nocase
        $no_check = "current_user_can" ascii wide nocase
    condition:
        ($func1 or $func2) and not $no_check
}

Sigma Rule

title: CVE-2024-4445 WP Compress Missing Authorization
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized AJAX requests to WP Compress settings endpoints
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 
            - 'action=wpc_save_settings'
            - 'action=wpc_update_option'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-4445 WP Compress Missing Authorization Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=wpc_save_settings"; http_client_body;
    sid:1000001;
    rev:1;
    metadata: cve CVE-2024-4445;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations, especially in multisite environments.
2. Restrict user roles – ensure only trusted administrators have subscriber-level access.
3. Implement Web Application Firewall (WAF) rules to block AJAX requests to WP Compress endpoints from non-admin users.

Long-term Fix:

• Apply a patch from the vendor once available. In the interim, manually add capability checks to the plugin’s PHP files (e.g., if (!current_user_can('manage_options')) { wp_die(); }).
• Monitor the WordPress plugin repository for updates.

Workaround:

• Use a security plugin (e.g., Wordfence) to enforce role-based access to AJAX actions.

Valters IT