CVE-2024-6579

Executive Summary

CVE-2024-6579 is a Missing Authorization vulnerability in the WordPress plugin "Web and WooCommerce Addons for WPBakery Builder" (developed by Wpbakery). This flaw allows authenticated attackers with Subscriber-level access or higher to modify plugin settings without proper capability checks. The vulnerability affects all versions up to and including 1.4.5. With a CVSS score of 4.3 (Medium), the primary risk is unauthorized configuration changes that could lead to further exploitation, such as defacement, data exfiltration, or privilege escalation. No public exploit code or patch details are currently available, but the EPSS score is 0.0%, indicating low active exploitation.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem. Users should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs a valid WordPress account (Subscriber or higher).
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – The vulnerable component remains isolated.
• Confidentiality Impact: None (C:N) – No direct data disclosure.
• Integrity Impact: Low (I:L) – Unauthorized modification of plugin settings.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the direct impact is limited to settings modification, this can be a stepping stone for more severe attacks, such as injecting malicious content or disabling security features.

Deep Dive & Mechanics

The vulnerability stems from missing capability checks in several plugin functions. In WordPress, functions that handle settings updates should verify that the current user has the appropriate permissions (e.g., manage_options). The plugin "Web and WooCommerce Addons for WPBakery Builder" fails to perform these checks, allowing any authenticated user (Subscriber and above) to modify plugin settings via AJAX or direct POST requests.

Affected Functions: The plugin likely exposes functions like save_settings(), update_option(), or similar handlers that are registered via wp_ajax_ hooks. Without a current_user_can() check, these functions process requests from any logged-in user.

Attack Flow:

1. Attacker logs in as a Subscriber (or higher).
2. Attacker crafts a POST request to the vulnerable AJAX endpoint with malicious parameters.
3. The plugin updates its settings (e.g., enabling debug mode, changing API keys, or altering display options).
4. The attacker can then exploit the modified settings for further attacks (e.g., XSS, data leakage).

Vulnerable vs. Patched Code

Vulnerable Code (Example):

add_action('wp_ajax_save_plugin_settings', 'save_plugin_settings');
function save_plugin_settings() {
    // Missing capability check
    update_option('plugin_setting', $_POST['setting_value']);
    wp_die();
}

Patched Code (Expected):

add_action('wp_ajax_save_plugin_settings', 'save_plugin_settings');
function save_plugin_settings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    update_option('plugin_setting', sanitize_text_field($_POST['setting_value']));
    wp_die();
}

The patch adds a current_user_can('manage_options') check to ensure only administrators can modify settings. Additionally, input sanitization should be applied.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with the vulnerable plugin (version <= 1.4.5).
• A valid user account with Subscriber role or higher.

Exploitation Steps:

1. Log in to WordPress as a Subscriber.
2. Identify the AJAX action used for settings (e.g., save_plugin_settings). This can be found by inspecting the plugin's JavaScript or source code.
3. Send a crafted POST request using a tool like curl:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
     -d "action=save_plugin_settings&setting_value=malicious_value" \
     --cookie "wordpress_logged_in_xxx=session_cookie"
   

4. Verify the settings change by checking the plugin's configuration page or database.

Note: No public exploit code is available, so this is a conceptual demonstration.

Blue Team (Defensive)

Detection:

• Monitor for unusual AJAX requests from low-privilege users to plugin-specific endpoints.
• Look for changes to plugin options in the wp_options table (e.g., option_name like %plugin_setting%).
• Use Web Application Firewall (WAF) rules to block requests to admin-ajax.php with suspicious parameters from non-admin users.

Hunting:

• Query WordPress logs for wp_ajax_* actions triggered by Subscriber or Contributor roles.
• Check for unexpected modifications to plugin settings via database queries:

  SELECT * FROM wp_options WHERE option_name LIKE '%wpbakery%' AND option_value != expected_value;
  

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=save_plugin_settings (or similar) from low-privilege users.
• Host: Modified plugin settings in the wp_options table (e.g., wpbakery_addons_settings).
• File: Unexpected changes to plugin configuration files (e.g., /wp-content/plugins/web-and-woocommerce-addons-for-wpbakery-builder/config.php).
• Log: WordPress debug log entries showing unauthorized AJAX calls.

Detection Engineering

YARA Rule

rule CVE_2024_6579_WordPress_Plugin_Missing_Auth
{
    meta:
        description = "Detects vulnerable plugin files with missing capability checks"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6579"
    strings:
        $func1 = "add_action('wp_ajax_" ascii wide nocase
        $func2 = "update_option(" ascii wide nocase
        $func3 = "current_user_can" ascii wide nocase
    condition:
        $func1 and $func2 and not $func3
}

Sigma Rule

title: CVE-2024-6579 - Unauthorized Plugin Settings Modification
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects AJAX requests to modify plugin settings without proper authorization
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=save_plugin_settings'
    condition: selection
falsepositives:
    - Legitimate admin actions (if action name is generic)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-6579 - WordPress Plugin Settings Modification Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=save_plugin_settings"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to the latest version if a patch becomes available. Check the WordPress plugin repository for updates.
2. Disable the plugin if no patch is available and the functionality is not critical.
3. Restrict user roles – Remove Subscriber accounts that do not require access, or use a plugin like "User Role Editor" to limit capabilities.

Long-term Measures:

• Implement a Web Application Firewall (WAF) to block unauthorized AJAX requests.
• Regularly audit WordPress user roles and permissions.
• Monitor plugin updates and apply patches promptly.
• Use a security plugin (e.g., Wordfence) to detect and block exploitation attempts.

Workaround:

• Add a custom code snippet to the theme's functions.php to enforce capability checks:

  add_action('wp_ajax_save_plugin_settings', function() {
      if (!current_user_can('manage_options')) {
          wp_die('Unauthorized');
      }
  }, 1);
  

Valters IT – Securing Digital Frontiers