CVE-2024-5940

Executive Summary

CVE-2024-5940 is a missing authorization vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw resides in the handle_request function, which fails to perform a capability check before processing requests. This allows unauthenticated attackers to modify event ticket settings when the Events beta feature is enabled. The vulnerability affects all versions up to and including 3.13.0. With a CVSS score of 6.5 (Medium), the primary impact is on data integrity, as an attacker can alter ticket configurations without authentication. No public proof-of-concept or exploit code has been released, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The GiveWP plugin is distributed via the official WordPress plugin repository and is also available for direct download. Organizations using this plugin should verify their version and apply any available updates immediately. Since the patch status is unknown, users must monitor the vendor’s release notes for a patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the low integrity impact and the requirement that the Events beta feature be enabled. However, the lack of authentication makes it easily exploitable.

Deep Dive & Mechanics

The vulnerability exists in the handle_request function of the GiveWP plugin. This function is responsible for processing AJAX requests related to event ticket settings when the Events beta feature is active. The code does not include a capability check (e.g., current_user_can('manage_options')) before executing modifications. As a result, any unauthenticated user can send a crafted HTTP request to the WordPress admin-ajax endpoint with the appropriate action parameter to alter ticket settings.

The affected code path is typically triggered via wp_ajax_* and wp_ajax_nopriv_* hooks. The missing check allows an attacker to change ticket prices, availability, or other settings without authorization.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.13.0):

public function handle_request() {
    // No capability check
    $event_id = $_POST['event_id'];
    $ticket_settings = $_POST['ticket_settings'];
    update_post_meta($event_id, '_give_ticket_settings', $ticket_settings);
    wp_send_json_success();
}

Patched Code (Hypothetical):

public function handle_request() {
    if (!current_user_can('manage_options')) {
        wp_send_json_error('Unauthorized');
        return;
    }
    $event_id = $_POST['event_id'];
    $ticket_settings = $_POST['ticket_settings'];
    update_post_meta($event_id, '_give_ticket_settings', $ticket_settings);
    wp_send_json_success();
}

The patch adds a capability check using current_user_can('manage_options') to ensure only administrators can modify ticket settings.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would send a POST request to the WordPress admin-ajax endpoint with the appropriate action. Below is a sample curl command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=give_events_handle_request&event_id=123&ticket_settings[price]=0.01"

This would change the ticket price for event ID 123 to 0.01. The attacker can enumerate event IDs or use other techniques to find valid events.

Blue Team

To detect exploitation attempts, monitor for unusual POST requests to /wp-admin/admin-ajax.php with the action parameter give_events_handle_request. Additionally, log all changes to event ticket settings and alert on unauthorized modifications.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=give_events_handle_request
• Logs: WordPress debug logs showing update_post_meta calls for _give_ticket_settings without a valid user session
• File: Modified event ticket settings in the database (post meta _give_ticket_settings)

Detection Engineering

YARA Rule

rule CVE_2024_5940_GiveWP_Missing_Auth {
    meta:
        description = "Detects GiveWP plugin files vulnerable to CVE-2024-5940"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5940"
    strings:
        $func = "handle_request" ascii wide nocase
        $no_check = "current_user_can" ascii wide nocase
    condition:
        $func and not $no_check
}

Sigma Rule

title: CVE-2024-5940 GiveWP Unauthenticated Ticket Settings Modification
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-5940 via admin-ajax.php
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=give_events_handle_request'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2024-5940 GiveWP Unauthenticated Ticket Settings Modification";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=give_events_handle_request"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable the Events beta feature in GiveWP settings if not required.
2. Update: Apply the latest GiveWP plugin version as soon as a patch is released. Monitor the vendor’s changelog.
3. Workaround: Add a custom capability check via a WordPress plugin or code snippet to the handle_request function.
4. Monitoring: Enable logging for all admin-ajax requests and review for suspicious activity.
5. Web Application Firewall (WAF): Create a rule to block requests to /wp-admin/admin-ajax.php with action=give_events_handle_request from unauthenticated users.

Valters IT
Securing Digital Frontiers