CVE-2024-53795

Executive Summary

CVE-2024-53795 is a Missing Authorization vulnerability in the Church Admin WordPress plugin (versions up to and including 5.0.8). This flaw allows unauthenticated attackers to access functionality that should be constrained by Access Control Lists (ACLs). The vulnerability is classified under CWE-862 (Missing Authorization) and has a CVSS score of 5.3 (Medium). No public proof-of-concept (PoC) or patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains due to the lack of a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates and consider disabling the plugin if no patch is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability allows unauthorized access to plugin functionality, potentially exposing sensitive church administration data.

Deep Dive & Mechanics

The Church Admin plugin provides administrative features for church management, including member lists, event scheduling, and financial records. The vulnerability stems from missing authorization checks on certain AJAX actions or REST API endpoints. An unauthenticated attacker can directly call these endpoints to access data or perform actions intended only for administrators.

Root Cause: The plugin fails to verify user capabilities (e.g., manage_options or edit_posts) before executing sensitive functions. This is common in WordPress plugins where developers assume that only authenticated users will access admin-ajax.php or REST routes.

Attack Vector: An attacker sends crafted HTTP requests to the vulnerable endpoints, bypassing authentication checks. For example:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded

action=church_admin_get_members&nonce=...

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below.

Vulnerable Code (hypothetical):

add_action('wp_ajax_nopriv_church_admin_get_members', 'church_admin_get_members');
function church_admin_get_members() {
    // No capability check
    $members = get_members_from_db();
    wp_send_json($members);
}

Patched Code (expected):

add_action('wp_ajax_church_admin_get_members', 'church_admin_get_members');
function church_admin_get_members() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $members = get_members_from_db();
    wp_send_json($members);
}

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a WordPress instance with Church Admin <= 5.0.8.
2. Recon: Identify vulnerable endpoints by analyzing plugin source code or using fuzzing tools.
3. Exploit: Send unauthenticated requests to trigger the missing authorization.

   curl -X POST http://target/wp-admin/admin-ajax.php \
     -d "action=church_admin_get_members"
   

4. Data Exfiltration: Parse the JSON response to extract sensitive data.

Blue Team (Defense)

1. Detection: Monitor for unusual access to admin-ajax.php without authentication cookies.
2. Mitigation: Implement a Web Application Firewall (WAF) rule to block requests to known vulnerable endpoints.
3. Hardening: Disable the plugin until a patch is available. Use a security plugin to enforce capability checks.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/admin-ajax.php with action=church_admin_* parameters from unauthenticated sources.
• Logs: WordPress debug logs showing wp_ajax_nopriv_* hooks being triggered.
• File: Presence of unexpected files in /wp-content/uploads/ if the plugin allows file uploads.

Detection Engineering

YARA Rule

rule CVE_2024_53795_Church_Admin_Missing_Auth {
    meta:
        description = "Detects Church Admin plugin files with missing authorization"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-53795"
    strings:
        $vuln_func = "wp_ajax_nopriv_" nocase
        $plugin_path = "church-admin" nocase
    condition:
        $plugin_path and $vuln_func
}

Sigma Rule

title: Church Admin Missing Authorization Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated access to Church Admin AJAX endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=church_admin_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin actions (requires authentication)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-53795 Church Admin Missing Authorization Attempt";
    flow:to_server;
    content:"POST";
    http_method;
    content:"admin-ajax.php";
    http_uri;
    content:"action=church_admin_";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the Church Admin plugin until a patch is released.
2. Short-term: Implement a WAF rule to block requests to admin-ajax.php with action=church_admin_* from unauthenticated users.
3. Long-term: Apply the vendor patch when available. Consider replacing the plugin with an alternative that follows secure coding practices.
4. Monitoring: Enable detailed logging for AJAX requests and review logs for suspicious activity.

Valters IT
Securing Digital Frontiers