CVE-2024-50455

Executive Summary

CVE-2024-50455 is a Missing Authorization vulnerability in the SEOPress WordPress plugin (versions up to and including 8.1.1). This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of SEO metadata or other plugin settings. The vulnerability is classified as a WordPress ecosystem issue, specifically affecting the plugin's permission checks. With a CVSS score of 4.3 (Medium), the risk is elevated due to the lack of required authentication, though the impact is limited to integrity (low) with no confidentiality or availability impact. No public proof-of-concept (PoC) or exploit code has been released, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The SEOPress plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors leveraging this flaw in targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Limited data modification possible.
• Availability Impact: None (A:N)

Threat Level: Medium. The low EPSS score (0.0%) suggests limited active exploitation, but the unpatched status and ease of exploitation (no privileges required) make it a potential target for automated scanning and low-sophistication attacks.

Deep Dive & Mechanics

The vulnerability resides in the SEOPress plugin's authorization checks for certain AJAX actions or REST API endpoints. The plugin fails to properly validate user capabilities before executing sensitive operations, such as updating SEO titles, meta descriptions, or social media previews. An unauthenticated attacker can send crafted HTTP requests to these endpoints, bypassing the intended access controls.

Root Cause: The plugin uses current_user_can() or similar WordPress capability checks inconsistently, or relies on nonce verification without proper capability validation. This allows requests with a valid nonce (if any) but without the required user role to be processed.

Attack Vector: The attacker sends a POST request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php with action seopress_* or a custom REST route). The request includes parameters to modify SEO data, which the plugin processes without verifying the user's permissions.

Impact: An attacker could alter SEO metadata for posts, pages, or custom post types, potentially defacing the site's search engine listings, injecting malicious keywords, or redirecting traffic. This could damage the site's reputation and SEO rankings.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's main PHP files (e.g., wp-seopress.php or files in inc/). The missing authorization likely appears in functions handling AJAX requests or REST API callbacks.

Vulnerable Code Example (Hypothetical):

add_action('wp_ajax_seopress_update_meta', 'seopress_update_meta_callback');
add_action('wp_ajax_nopriv_seopress_update_meta', 'seopress_update_meta_callback'); // Missing capability check

function seopress_update_meta_callback() {
    // No check for current_user_can('edit_posts') or similar
    $post_id = intval($_POST['post_id']);
    $meta_value = sanitize_text_field($_POST['meta_value']);
    update_post_meta($post_id, '_seopress_meta', $meta_value);
    wp_die();
}

Patched Code (Expected):

add_action('wp_ajax_seopress_update_meta', 'seopress_update_meta_callback');
// Remove the nopriv hook to require authentication

function seopress_update_meta_callback() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    // ... rest of the function
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with SEOPress plugin version <= 8.1.1 installed and activated.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common targets include AJAX actions like seopress_save_meta, seopress_update_social, or REST routes under /wp-json/seopress/v1/.
2. Craft a POST request with the required parameters (e.g., post_id, meta_key, meta_value).
3. Send the request without any authentication cookies or tokens.
4. Verify the change by checking the post's SEO metadata.

Example cURL Command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=seopress_update_meta&post_id=1&meta_value=Hacked%20SEO%20Title"

Note: No public exploit code is available. The above is a hypothetical example based on common patterns.

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with actions containing seopress_ from unauthenticated sources.
• Look for unusual patterns in SEO metadata changes (e.g., bulk updates to posts without corresponding user activity).
• Use the Sigma and Suricata rules provided in the Detection Engineering section.

Defense:

• Immediately update the plugin if a patch becomes available.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to SEOPress AJAX endpoints.
• Restrict access to /wp-admin/admin-ajax.php using IP whitelisting or .htaccess rules.
• Monitor WordPress logs for failed capability checks.

Indicators of Compromise (IOCs)

• Network Indicators:
  • POST requests to /wp-admin/admin-ajax.php with action=seopress_* parameters from unknown IPs.
  • Unusual REST API calls to /wp-json/seopress/v1/* without authentication.
• File Indicators:
  • Modified _seopress_* post meta values in the database.
  • Unexpected changes to SEO titles, descriptions, or social media previews.
• Log Indicators:
  • WordPress debug log entries showing wp_ajax_nopriv_seopress_* actions being triggered.
  • Apache/Nginx access logs with 200 responses to AJAX endpoints from unauthenticated users.

Detection Engineering

YARA Rule

rule CVE_2024_50455_SEOPress_Missing_Auth {
    meta:
        description = "Detects SEOPress plugin files with missing authorization checks"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50455"
    strings:
        $ajax_hook = /add_action\(['\"]wp_ajax_nopriv_seopress_/
        $rest_route = /register_rest_route\(['\"]seopress\/v1/
        $cap_check = /current_user_can\(/
    condition:
        $ajax_hook and not $cap_check
}

Sigma Rule

title: CVE-2024-50455 - SEOPress Missing Authorization Exploitation
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1a3d4f5e6c
status: experimental
description: Detects unauthenticated POST requests to SEOPress AJAX endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - 'action=seopress_'
            - '/wp-json/seopress/v1/'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated users (if IP is whitelisted, adjust)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-50455 - SEOPress Missing Authorization Exploitation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=seopress_";
    http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-50455;
    classtype:attempted-admin;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the SEOPress plugin until a patch is released and applied.
2. Implement a WAF rule to block unauthenticated requests to SEOPress AJAX endpoints.
3. Review and revert any unauthorized SEO metadata changes by checking post revisions or database backups.

Long-Term Fix:

• Monitor the SEOPress plugin repository for a patched version (expected to be > 8.1.1).
• Apply the update as soon as it becomes available.
• Conduct a security audit of all WordPress plugins to ensure proper authorization checks.

Workaround:

• Add the following code to the theme's functions.php to disable unauthenticated AJAX access to SEOPress actions:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX && !is_user_logged_in()) {
        $action = $_REQUEST['action'] ?? '';
        if (strpos($action, 'seopress_') === 0) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT
Securing Digital Frontiers