CVE-2024-47311

Executive Summary

CVE-2024-47311 is a Missing Authorization vulnerability in the WordPress plugin Wheel of Life by Kraftplugins, affecting versions up to and including 1.1.8. The flaw allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data exposure or manipulation. With a CVSS score of 5.3 (Medium), the vulnerability is remotely exploitable without authentication, but requires no user interaction. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a patch makes it a persistent risk for sites using this plugin.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. The plugin is not managed via NPM, PyPI, Go, or Ruby, but its supply chain risk stems from the vendor's failure to patch and the plugin's inclusion in WordPress site builds. Organizations should inventory all WordPress plugins and assess exposure.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but offers limited impact. However, in the context of WordPress, it could expose sensitive user data or plugin settings.

Deep Dive & Mechanics

The Wheel of Life plugin provides a visual tool for life coaching. The vulnerability lies in missing authorization checks on AJAX actions or REST endpoints that handle wheel data. An unauthenticated attacker can send crafted HTTP requests to access or modify wheel configurations, user progress, or other protected data.

Root Cause: The plugin fails to validate user capabilities (e.g., wp_verify_nonce or current_user_can()) before executing privileged operations. This allows any visitor to trigger actions intended only for authenticated users with specific roles.

Attack Vector: HTTP GET/POST requests to endpoints like /wp-admin/admin-ajax.php with action parameters such as wheel_of_life_get_data or wheel_of_life_update_settings.

Impact: Unauthorized reading of wheel data (e.g., user goals, scores) or modification of plugin settings. In worst-case scenarios, this could lead to privilege escalation if combined with other vulnerabilities.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The missing authorization is typically in functions hooked to WordPress AJAX actions.

Vulnerable Code Example (hypothetical):

add_action('wp_ajax_nopriv_wheel_of_life_get_data', 'wheel_of_life_get_data');
function wheel_of_life_get_data() {
    // No capability check
    $user_id = $_GET['user_id'];
    $data = get_user_meta($user_id, 'wheel_of_life_data', true);
    wp_send_json($data);
}

Patched Code (hypothetical):

add_action('wp_ajax_wheel_of_life_get_data', 'wheel_of_life_get_data');
add_action('wp_ajax_nopriv_wheel_of_life_get_data', 'wheel_of_life_get_data');
function wheel_of_life_get_data() {
    if (!current_user_can('read') || !wp_verify_nonce($_REQUEST['_wpnonce'], 'wheel_of_life_nonce')) {
        wp_die('Unauthorized');
    }
    $user_id = get_current_user_id();
    $data = get_user_meta($user_id, 'wheel_of_life_data', true);
    wp_send_json($data);
}

Exploitation & Lab Setup

Red Team

Prerequisites: A WordPress site with Wheel of Life plugin version <= 1.1.8.

Exploitation Steps:

1. Identify the vulnerable endpoint by analyzing plugin source or using a tool like Burp Suite.
2. Send a crafted request to retrieve data:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
   -d "action=wheel_of_life_get_data&user_id=1"
   

3. If successful, the response will contain JSON data of the wheel configuration.

Automation Script (Python):

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
payload = {"action": "wheel_of_life_get_data", "user_id": "1"}
response = requests.post(target, data=payload)
print(response.text)

Blue Team

Detection: Monitor for unusual AJAX requests to admin-ajax.php with action parameters related to "wheel_of_life". Look for requests without a valid nonce or from unauthenticated users.

Honeypot: Deploy a fake endpoint that logs attacker IPs and payloads.

Mitigation: Disable the plugin immediately if not essential. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action containing wheel_of_life from unauthenticated sources.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=wheel_of_life_* parameters.
  • Source IPs not associated with legitimate admin users.
• File IOCs:
  • Plugin file /wp-content/plugins/wheel-of-life/wheel-of-life.php version <= 1.1.8.
• Log IOCs:
  • WordPress debug log entries showing wp_ajax_nopriv_wheel_of_life_* actions.

Detection Engineering

YARA Rule

rule CVE_2024_47311_Wheel_of_Life {
    meta:
        description = "Detects Wheel of Life plugin files vulnerable to CVE-2024-47311"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47311"
    strings:
        $vuln_func = "wp_ajax_nopriv_wheel_of_life" nocase
        $no_auth = "current_user_can" nocase
    condition:
        $vuln_func and not $no_auth
}

Sigma Rule

title: CVE-2024-47311 - Wheel of Life Missing Authorization
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts against CVE-2024-47311 in WordPress
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=wheel_of_life'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47311 - Wheel of Life Missing Authorization Exploit"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=wheel_of_life"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for business operations.
2. Apply a virtual patch using a WAF to block unauthenticated requests to admin-ajax.php with action containing wheel_of_life.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Since no official patch exists, consider forking the plugin and adding proper authorization checks (e.g., current_user_can() and nonce verification).
• Replace the plugin with an alternative solution if available.

Workaround:

• Restrict access to wp-admin/admin-ajax.php via .htaccess for unauthenticated users:

  <Files "admin-ajax.php">
      Require all denied
  </Files>
  

  (Note: This may break legitimate AJAX functionality.)

Valters IT
Securing Digital Frontiers