CVE-2024-6626

Executive Summary

CVE-2024-6626 is a Missing Authorization vulnerability in the EleForms – All In One Form Integration including DB for Elementor WordPress plugin, affecting all versions up to and including 2.9.9.9. The vulnerability allows unauthenticated attackers to view form submissions due to missing capability checks on several functions. This is a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). The CVSS score is 5.3 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public exploit code or proof-of-concept is available at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin files and monitor for any updates from the vendor. Since no patch is available, the plugin should be considered a supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is Medium due to the low complexity and no authentication requirement, but the impact is limited to data exposure (form submissions). The EPSS score of 0.0% suggests low exploitation probability, but this may change as more details emerge.

Deep Dive & Mechanics

The vulnerability resides in the EleForms plugin's AJAX handlers and REST endpoints that retrieve form submissions. The plugin fails to perform capability checks (e.g., current_user_can('manage_options')) before executing functions that return submission data. This allows any unauthenticated user to call these endpoints and retrieve sensitive data submitted through forms, including personal information, contact details, and other user-provided content.

The affected functions are likely registered via wp_ajax_ and wp_ajax_nopriv_ hooks, or via REST API routes. The missing capability check means that the nopriv (non-logged-in) handlers are not properly restricted.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern. The vulnerable code likely looks like:

// Vulnerable: No capability check
add_action('wp_ajax_nopriv_eleforms_get_submissions', 'eleforms_get_submissions');
function eleforms_get_submissions() {
    // Directly returns submission data without checking user permissions
    $submissions = get_all_submissions();
    wp_send_json_success($submissions);
}

A patched version would include a capability check:

// Patched: Capability check added
add_action('wp_ajax_eleforms_get_submissions', 'eleforms_get_submissions');
function eleforms_get_submissions() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $submissions = get_all_submissions();
    wp_send_json_success($submissions);
}

Note: The nopriv hook should be removed entirely for admin-only functions.

Exploitation & Lab Setup

Red Team

Since no public exploit code is available, the following steps outline a manual exploitation approach:

1. Identify the vulnerable endpoint: Use a tool like Burp Suite or curl to enumerate AJAX actions. Common patterns include:

   • /wp-admin/admin-ajax.php?action=eleforms_get_submissions
   • /wp-json/eleforms/v1/submissions

2. Craft the request: Send a GET or POST request to the endpoint without any authentication cookies.

   curl -X GET "http://target.com/wp-admin/admin-ajax.php?action=eleforms_get_submissions"
   

3. Extract data: If successful, the response will contain JSON with form submission data.

Blue Team

To detect exploitation attempts:

1. Monitor for unusual AJAX requests: Look for requests to admin-ajax.php with actions containing eleforms from unauthenticated users.
2. Check access logs: Search for 200 responses to admin-ajax.php with action=eleforms_* from IPs not associated with admin users.
3. Deploy a WAF rule: Block requests to admin-ajax.php where the action parameter starts with eleforms_ and the request is not from an authenticated admin session.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=eleforms_get_submissions or similar eleforms_* actions.
  • HTTP requests to /wp-json/eleforms/v1/submissions or similar REST endpoints.
  • Source IPs making repeated unauthenticated requests to these endpoints.

• File IOCs:

  • Plugin files in /wp-content/plugins/eleforms/ (all versions up to 2.9.9.9).
  • Log entries in web server access logs showing 200 responses to the above endpoints from unauthenticated users.

• Behavioral IOCs:

  • Unusual spikes in database queries related to form submissions.
  • Unexpected access to the wp_eleforms_submissions database table (or similar).

Detection Engineering

YARA Rule

rule Detect_EleForms_Vulnerable_Plugin {
    meta:
        description = "Detects vulnerable EleForms plugin files (CVE-2024-6626)"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-6626"
    strings:
        $func1 = "eleforms_get_submissions" ascii wide nocase
        $func2 = "wp_ajax_nopriv_eleforms" ascii wide nocase
        $func3 = "current_user_can" ascii wide nocase
    condition:
        ($func1 or $func2) and not $func3
}

Sigma Rule

title: Unauthenticated Access to EleForms Submissions
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access attempts to EleForms plugin submission endpoints (CVE-2024-6626)
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=eleforms_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin users (should be authenticated)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6626 - EleForms Unauthenticated Submission Access"; flow:to_server; content:"GET"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=eleforms_"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the EleForms plugin until a patched version is released.
2. Workaround: Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to admin-ajax.php with action parameters starting with eleforms_.
3. Long-term: Monitor the plugin's official page for updates. When a patched version is released (e.g., 2.9.9.10 or higher), update immediately.
4. Data Exposure: If the plugin was used to collect sensitive data, assume it may have been compromised. Notify affected users and consider resetting any credentials submitted through forms.
5. Audit: Review server logs for any unauthorized access to form submission endpoints.

Valters IT
Securing Digital Frontiers