CVE-2024-5987

Executive Summary

CVE-2024-5987 is a missing authorization vulnerability in the WordPress plugin WP Accessibility Helper (WAH). The plugin fails to perform proper capability checks on the save_contrast_variations and save_empty_contrast_variations AJAX functions. This allows any authenticated user, including those with only Subscriber-level access, to modify or delete contrast settings. The vulnerability has a CVSS score of 5.4 (Medium) and affects all versions up to and including 0.6.2.8. While the vendor attempted a patch in version 0.6.2.8, it broke functionality and remains unverified.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who install the plugin via the WordPress admin dashboard or through automated deployment tools (e.g., Composer, WP-CLI) are at risk. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: Low

The threat level is considered Medium due to the low privileges required and the potential for authenticated attackers to disrupt accessibility features, which could impact user experience and compliance.

Deep Dive & Mechanics

The WP Accessibility Helper plugin registers AJAX actions for saving contrast variations. The functions save_contrast_variations and save_empty_contrast_variations are hooked to WordPress AJAX actions but lack a current_user_can() check. This means any authenticated user can call these endpoints.

The vulnerable code likely looks like:

add_action('wp_ajax_save_contrast_variations', 'save_contrast_variations');
function save_contrast_variations() {
    // No capability check
    // Process and save contrast settings
}

An attacker with Subscriber-level access can send a POST request to /wp-admin/admin-ajax.php with the appropriate action parameter to modify or delete contrast settings. This could be used to deface the site's accessibility options or cause denial of service for users relying on contrast adjustments.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.6.2.8):

add_action('wp_ajax_save_contrast_variations', 'save_contrast_variations');
function save_contrast_variations() {
    // No capability check
    $variations = $_POST['variations'];
    update_option('wah_contrast_variations', $variations);
    wp_die();
}

Patched Code (0.6.2.8 - incomplete):

add_action('wp_ajax_save_contrast_variations', 'save_contrast_variations');
function save_contrast_variations() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $variations = $_POST['variations'];
    update_option('wah_contrast_variations', $variations);
    wp_die();
}

The patch adds a capability check for manage_options, but the vendor reported that this broke functionality, suggesting the check may be too restrictive or the AJAX hooks are not properly registered for administrators.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with WP Accessibility Helper plugin version <= 0.6.2.8
• A valid user account with Subscriber-level access (e.g., username: attacker, password: password)

Exploitation Steps:

1. Authenticate to the WordPress site and obtain a nonce if required (the plugin may not use nonces).
2. Send a POST request to /wp-admin/admin-ajax.php with the following payload:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-wordpress-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: [authenticated session cookie]

action=save_contrast_variations&variations=malicious_data

3. Verify the contrast settings have been modified by checking the site's frontend or the database option wah_contrast_variations.

Alternative Payload for Deletion:

action=save_empty_contrast_variations

Blue Team

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with actions save_contrast_variations or save_empty_contrast_variations from non-admin users.
2. Audit user roles and ensure only trusted users have Subscriber-level access.
3. Check database for unexpected values in the wah_contrast_variations option.

Lab Setup:

• Use a local WordPress instance (e.g., via Docker) with the vulnerable plugin installed.
• Create a Subscriber user and test the exploit.
• Monitor logs using a SIEM or WordPress debug log.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=save_contrast_variations or action=save_empty_contrast_variations from non-admin IPs.
• File: Modified or deleted contrast settings in the WordPress database option wah_contrast_variations.
• Log: WordPress debug log entries showing AJAX calls from unexpected user roles.

Detection Engineering

YARA Rule

rule CVE_2024_5987_WP_Accessibility_Helper {
    meta:
        description = "Detects exploitation attempts for CVE-2024-5987 in WP Accessibility Helper plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5987"
    strings:
        $ajax_action1 = "save_contrast_variations"
        $ajax_action2 = "save_empty_contrast_variations"
        $wp_ajax = "admin-ajax.php"
    condition:
        any of ($ajax_action*) and $wp_ajax
}

Sigma Rule

title: CVE-2024-5987 WP Accessibility Helper Unauthorized Contrast Modification
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized AJAX requests to modify contrast settings in WP Accessibility Helper plugin
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=save_contrast_variations'
            - 'action=save_empty_contrast_variations'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5987 WP Accessibility Helper Unauthorized Contrast Modification"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=save_contrast_variations"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a verified patch is released.
2. Restrict user roles to prevent Subscriber-level accounts from accessing AJAX endpoints (e.g., using a security plugin like Wordfence).
3. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with the vulnerable actions from non-admin users.

Long-term Fix:

• The vendor must release a proper patch that checks for edit_posts or a custom capability appropriate for the functionality, and ensure the AJAX hooks are correctly registered for all user roles that need them.

Workaround:

• Add the following code to the theme's functions.php to override the vulnerable functions:

add_action('init', 'fix_wah_authorization');
function fix_wah_authorization() {
    if (current_user_can('subscriber')) {
        remove_action('wp_ajax_save_contrast_variations', 'save_contrast_variations');
        remove_action('wp_ajax_save_empty_contrast_variations', 'save_empty_contrast_variations');
    }
}

Valters IT
Securing WordPress, One Plugin at a Time