CVE-2024-5941

Executive Summary

CVE-2024-5941 is a missing capability check vulnerability in the GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress, affecting all versions up to and including 3.14.1. The flaw resides in the handle_request function, which fails to enforce proper authorization checks. This allows authenticated attackers with Subscriber-level access or higher to read attachment paths and delete attachment files without proper permissions. The vulnerability has a CVSS score of 5.4 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code has been released, and the vendor has not provided a patch. This is a WordPress ecosystem issue, not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects the GiveWP plugin distributed via the WordPress plugin repository. Users should monitor for updates from the vendor and consider disabling the plugin until a patch is available. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (attachment paths exposed)
• Integrity Impact: None
• Availability Impact: Low (attachment files can be deleted)

The threat level is Medium due to the low privileges required and the potential for data exposure and denial of service through file deletion.

Deep Dive & Mechanics

The vulnerability exists in the handle_request function of the GiveWP plugin. This function is responsible for processing AJAX requests related to attachment management. The code fails to perform a capability check (e.g., current_user_can('manage_options')) before allowing actions such as reading attachment paths or deleting attachment files. As a result, any authenticated user with Subscriber-level access can trigger these actions.

The affected endpoint is likely registered via wp_ajax_ hooks, making it accessible to authenticated users. The missing capability check means that the function does not verify if the user has the necessary permissions (e.g., edit_posts, upload_files, or delete_posts) to perform the requested operation.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.14.1):

public function handle_request() {
    // No capability check
    $action = $_POST['action'];
    if ($action === 'givewp_delete_attachment') {
        $attachment_id = intval($_POST['attachment_id']);
        wp_delete_attachment($attachment_id, true);
    } elseif ($action === 'givewp_get_attachment_path') {
        $attachment_id = intval($_POST['attachment_id']);
        $path = get_attached_file($attachment_id);
        wp_send_json_success(array('path' => $path));
    }
}

Patched Code (Hypothetical):

public function handle_request() {
    // Proper capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $action = $_POST['action'];
    if ($action === 'givewp_delete_attachment') {
        $attachment_id = intval($_POST['attachment_id']);
        wp_delete_attachment($attachment_id, true);
    } elseif ($action === 'givewp_get_attachment_path') {
        $attachment_id = intval($_POST['attachment_id']);
        $path = get_attached_file($attachment_id);
        wp_send_json_success(array('path' => $path));
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with GiveWP plugin <= 3.14.1 installed and activated.
• Authenticated user account with Subscriber-level privileges.

Exploitation Steps:

1. Log in as a Subscriber.
2. Obtain a nonce or directly craft AJAX requests to the vulnerable endpoints.
3. To read an attachment path:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   action=givewp_get_attachment_path&attachment_id=123
   

4. To delete an attachment:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   action=givewp_delete_attachment&attachment_id=123
   

Note: No public exploit code is available; this is a manual exploitation scenario.

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with actions givewp_get_attachment_path or givewp_delete_attachment from low-privileged users.
• Alert on unusual attachment deletion activity by non-admin users.

Hunting:

• Search logs for action=givewp_get_attachment_path or action=givewp_delete_attachment originating from Subscriber or Contributor roles.
• Review file deletion events in WordPress audit logs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with parameters action=givewp_get_attachment_path or action=givewp_delete_attachment.
• File System IOCs:
  • Unexpected deletion of attachment files in /wp-content/uploads/.
• Log IOCs:
  • WordPress debug log entries showing wp_delete_attachment calls by unauthorized users.

Detection Engineering

YARA Rule

rule Detect_GiveWP_Missing_Capability_Check {
    meta:
        description = "Detects GiveWP plugin files with missing capability check in handle_request function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5941"
    strings:
        $func = "function handle_request" nocase
        $no_cap = "current_user_can" nocase
        $action_get = "givewp_get_attachment_path" nocase
        $action_del = "givewp_delete_attachment" nocase
    condition:
        $func and ($action_get or $action_del) and not $no_cap
}

Sigma Rule

title: GiveWP Unauthorized Attachment Access/Deletion
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-5941 by accessing or deleting attachments via GiveWP plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query:
            - '*action=givewp_get_attachment_path*'
            - '*action=givewp_delete_attachment*'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5941 GiveWP Unauthorized Attachment Access"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=givewp_get_attachment_path"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

alert http any any -> any any (msg:"CVE-2024-5941 GiveWP Unauthorized Attachment Deletion"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=givewp_delete_attachment"; http_client_body; classtype:attempted-dos; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the GiveWP plugin until a patched version is released.
2. Restrict user roles: Remove Subscriber accounts or limit their capabilities.
3. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with the vulnerable actions from low-privileged users.

Long-term Fix:

• Apply the vendor patch when available (monitor https://wordpress.org/plugins/give/).
• If custom development is possible, add capability checks to the handle_request function as shown in the patched code example.

Workaround:

• Use a plugin like "User Role Editor" to remove the read capability from Subscribers, but this may break other functionality.

Valters IT
Securing Digital Frontiers