CVE-2024-6491

Executive Summary

CVE-2024-6491 is a Missing Authorization vulnerability in the Getwid – Gutenberg Blocks WordPress plugin, affecting all versions up to and including 2.0.10. The flaw resides in the mailchimp_api_key_manage function, which lacks a proper capability check. This allows authenticated attackers with Contributor-level access or higher to arbitrarily set the MailChimp API key for the site. While the CVSS score is 4.3 (Medium), the impact is significant in a WordPress ecosystem because an attacker can redirect newsletter subscriptions, exfiltrate subscriber data, or disrupt email marketing operations. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is elevated for sites with untrusted Contributor-level users.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No patched version has been released by the vendor. Site administrators must manually apply a workaround or remove the plugin until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (API key modification)
• Availability Impact: None

Threat Level: Medium. The vulnerability is easy to exploit but requires authenticated access. The primary risk is data integrity and potential downstream compromise of MailChimp integration.

Deep Dive & Mechanics

The vulnerability exists in the mailchimp_api_key_manage function within the Getwid plugin. This function is intended to allow administrators to set the MailChimp API key for newsletter integration. However, the function is registered via WordPress AJAX hooks without a capability check (e.g., current_user_can('manage_options')). As a result, any authenticated user with at least Contributor privileges can call the AJAX endpoint and modify the API key.

Technical Flow:

1. An attacker logs in as a Contributor (or higher).
2. The attacker sends a POST request to /wp-admin/admin-ajax.php with action=getwid_mailchimp_api_key_manage and a new API key.
3. The plugin processes the request and updates the option in the database without verifying the user's role.
4. The attacker can then use their own MailChimp API key to intercept or manipulate newsletter data.

Root Cause: Missing capability check in the AJAX handler. The function should have checked for manage_options capability before processing the request.

Vulnerable vs. Patched Code

Vulnerable Code (Getwid <= 2.0.10):

add_action('wp_ajax_getwid_mailchimp_api_key_manage', 'getwid_mailchimp_api_key_manage');
function getwid_mailchimp_api_key_manage() {
    // No capability check
    $api_key = sanitize_text_field($_POST['api_key']);
    update_option('getwid_mailchimp_api_key', $api_key);
    wp_send_json_success();
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_getwid_mailchimp_api_key_manage', 'getwid_mailchimp_api_key_manage');
function getwid_mailchimp_api_key_manage() {
    if (!current_user_can('manage_options')) {
        wp_send_json_error('Unauthorized');
        return;
    }
    $api_key = sanitize_text_field($_POST['api_key']);
    update_option('getwid_mailchimp_api_key', $api_key);
    wp_send_json_success();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Getwid plugin <= 2.0.10
• Valid user account with Contributor role or higher
• Access to the WordPress admin AJAX endpoint

Exploitation Steps:

1. Obtain a valid session cookie for a Contributor-level user.
2. Send a POST request to the AJAX endpoint:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -H "Cookie: wordpress_logged_in_<hash>=<session_cookie>" \
  -d "action=getwid_mailchimp_api_key_manage&api_key=ATTACKER_CONTROLLED_KEY"

3. Verify the API key was changed by checking the plugin settings or by observing MailChimp integration behavior.

Expected Response:

{"success":true}

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=getwid_mailchimp_api_key_manage from non-admin users.
• Alert on changes to the getwid_mailchimp_api_key option in the database.

Hardening:

• Remove the plugin until a patch is available.
• Restrict Contributor-level users from accessing AJAX endpoints via a Web Application Firewall (WAF) rule.
• Implement a custom plugin that adds capability checks to the vulnerable function.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=getwid_mailchimp_api_key_manage from low-privilege user agents.
• File: No file changes; the vulnerability is logic-based.
• Database: The wp_options table entry getwid_mailchimp_api_key may contain an unexpected API key.
• Log: WordPress debug logs may show AJAX calls from unexpected user roles.

Detection Engineering

YARA Rule

rule CVE_2024_6491_Getwid_Missing_Auth {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6491 in Getwid plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6491"
    strings:
        $ajax_action = "getwid_mailchimp_api_key_manage"
        $api_key_param = "api_key"
    condition:
        $ajax_action and $api_key_param
}

Sigma Rule

title: CVE-2024-6491 Getwid MailChimp API Key Unauthorized Modification
id: 8a3f7c2e-1b4d-4f6a-9c8e-0d1e2f3a4b5c
status: experimental
description: Detects unauthorized AJAX requests to modify the MailChimp API key via Getwid plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=getwid_mailchimp_api_key_manage'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6491 Getwid MailChimp API Key Unauthorized Modification"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=getwid_mailchimp_api_key_manage"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the Getwid plugin until a patched version is released.
2. Audit user roles and remove any untrusted Contributor-level accounts.
3. Change the MailChimp API key if it was compromised.

Long-term Fix:

• The vendor must release a patched version that adds a capability check (current_user_can('manage_options')) to the mailchimp_api_key_manage function.
• Alternatively, apply a virtual patch via a WAF to block AJAX requests to this action from non-admin users.

Workaround:

• Add the following code to a custom plugin or theme's functions.php to enforce capability checks:

add_action('wp_ajax_getwid_mailchimp_api_key_manage', function() {
    if (!current_user_can('manage_options')) {
        wp_send_json_error('Unauthorized');
    }
}, 1);

Valters IT
Securing Digital Frontiers