CVE-2024-6175

Executive Summary

CVE-2024-6175 is a Missing Authorization vulnerability in the Booking Ultra Pro Appointments Booking Calendar Plugin for WordPress. This flaw allows authenticated attackers with Subscriber-level access or higher to modify and delete various plugin options and data via AJAX calls. The affected functions include save_fields_settings, bup_delete_user_avatar, bup_crop_avatar_user_profile_image, and more. The vulnerability exists in all versions up to and including 1.1.13. The CVSS score is 5.4 (Medium), and the EPSS probability is 0.0%, indicating low exploitation likelihood currently. No public exploit code or patch is available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The plugin fails to enforce proper capability checks on AJAX handlers, allowing low-privileged users to perform administrative actions. This is a classic case of Broken Access Control (CWE-862) in a WordPress plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The vulnerability allows modification of plugin data (payments, pricing, bookings, business hours, calendars, profile info, email templates) but not direct data theft or full site takeover. However, it could be used to disrupt business operations or manipulate pricing.

Deep Dive & Mechanics

The vulnerability stems from missing capability checks in multiple AJAX callback functions. In WordPress, AJAX handlers should verify user capabilities (e.g., manage_options) before processing requests. The affected plugin's functions like save_fields_settings, bup_delete_user_avatar, and bup_crop_avatar_user_profile_image do not perform such checks, allowing any authenticated user (Subscriber or above) to call them.

Affected Functions (non-exhaustive):

• save_fields_settings – modifies plugin settings
• bup_delete_user_avatar – deletes user avatars
• bup_crop_avatar_user_profile_image – crops profile images
• Additional functions for payments, pricing, booking info, business hours, calendars, and email templates

Attack Flow:

1. Attacker authenticates as a Subscriber (or higher).
2. Attacker crafts AJAX requests to the vulnerable endpoints.
3. The plugin processes the request without checking if the user has administrative privileges.
4. Attacker modifies or deletes plugin data.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Conceptual):

add_action('wp_ajax_save_fields_settings', 'save_fields_settings');
function save_fields_settings() {
    // Missing capability check
    update_option('bup_fields', $_POST['fields']);
    wp_die();
}

Patched Code (Expected):

add_action('wp_ajax_save_fields_settings', 'save_fields_settings');
function save_fields_settings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    update_option('bup_fields', $_POST['fields']);
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Booking Ultra Pro <= 1.1.13
• Valid user account with Subscriber role or higher
• Knowledge of AJAX action names

Exploitation Steps:

1. Log in as a Subscriber.
2. Obtain a valid nonce (if required) by inspecting the plugin's JavaScript.
3. Send a crafted AJAX request to modify settings:

curl -X POST 'https://target.com/wp-admin/admin-ajax.php' \
  -H 'Cookie: wordpress_logged_in_xxx=...' \
  -d 'action=save_fields_settings&fields[payment_method]=paypal&_ajax_nonce=...'

4. To delete a user avatar:

curl -X POST 'https://target.com/wp-admin/admin-ajax.php' \
  -H 'Cookie: wordpress_logged_in_xxx=...' \
  -d 'action=bup_delete_user_avatar&user_id=1&_ajax_nonce=...'

Note: No public exploit code is available. The above is conceptual.

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with actions related to Booking Ultra Pro from low-privileged users.
• Look for unusual modifications to plugin options or user profile data.
• Use the Sigma rule below to detect exploitation attempts.

Hunting:

• Search logs for action=save_fields_settings or action=bup_delete_user_avatar from non-admin users.
• Check for sudden changes in plugin settings or user avatars.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with parameters like action=save_fields_settings, action=bup_delete_user_avatar, action=bup_crop_avatar_user_profile_image
• File System:
  • Modified plugin options in wp_options table (e.g., bup_fields)
  • Deleted or altered user avatar files in /wp-content/uploads/
• Logs:
  • WordPress debug log entries showing unauthorized AJAX calls

Detection Engineering

YARA Rule

rule CVE_2024_6175_Booking_Ultra_Pro_AJAX {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6175 in Booking Ultra Pro plugin"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6175"
    strings:
        $ajax_action1 = "save_fields_settings"
        $ajax_action2 = "bup_delete_user_avatar"
        $ajax_action3 = "bup_crop_avatar_user_profile_image"
        $wp_ajax = "admin-ajax.php"
    condition:
        any of ($ajax_action*) and $wp_ajax
}

Sigma Rule

title: CVE-2024-6175 Booking Ultra Pro AJAX Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized AJAX requests to Booking Ultra Pro plugin endpoints
author: Valters IT
date: 2025/04/17
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6175
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'action=save_fields_settings'
            - 'action=bup_delete_user_avatar'
            - 'action=bup_crop_avatar_user_profile_image'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6175 Booking Ultra Pro AJAX Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=save_fields_settings" || content:"action=bup_delete_user_avatar" || content:"action=bup_crop_avatar_user_profile_image"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict user roles – ensure only trusted users have accounts.
3. Implement Web Application Firewall (WAF) rules to block AJAX requests to vulnerable endpoints from non-admin users.

Long-term:

• Monitor the plugin vendor for updates and apply patches immediately.
• Conduct a security audit of all WordPress plugins for similar missing capability checks.
• Implement principle of least privilege for all users.

Workaround:

• Add custom code to the theme's functions.php to enforce capability checks:

add_action('init', function() {
    $vulnerable_actions = ['save_fields_settings', 'bup_delete_user_avatar', 'bup_crop_avatar_user_profile_image'];
    foreach ($vulnerable_actions as $action) {
        add_action("wp_ajax_$action", function() use ($action) {
            if (!current_user_can('manage_options')) {
                wp_die('Unauthorized');
            }
        }, 0);
    }
});

Valters IT
Securing Digital Frontiers