CVE-2024-6799

Executive Summary

CVE-2024-6799 is a WordPress plugin vulnerability affecting the YITH Essential Kit for WooCommerce #1 plugin (versions up to and including 2.34.0). The issue stems from a missing capability check on the activate_module, deactivate_module, and install_module AJAX functions. This allows authenticated attackers with Subscriber-level access or higher to install, activate, or deactivate a pre-defined list of YITH plugins without proper authorization. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating limited active exploitation in the wild. No public proof-of-concept (PoC) or exploit code is currently available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem and does not involve NPM, PyPI, Go, or Ruby packages. The risk is limited to WordPress sites running the vulnerable plugin, where an attacker with minimal privileges can manipulate the plugin’s module state.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely via HTTP requests.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to be authenticated.
• Privileges Required (PR): Low (L) – Subscriber-level access is sufficient.
• User Interaction (UI): None (N) – No user action is needed beyond the attacker’s own actions.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality Impact (C): None (N) – No data disclosure.
• Integrity Impact (I): Low (L) – The attacker can install, activate, or deactivate plugins, altering site functionality.
• Availability Impact (A): None (N) – No denial of service.

Threat Level: Medium. While the impact is limited to plugin management, an attacker could install a malicious YITH plugin (if available) or deactivate security-related plugins, potentially leading to further compromise.

Deep Dive & Mechanics

The YITH Essential Kit for WooCommerce #1 plugin provides a dashboard for managing YITH plugins. The vulnerability lies in the AJAX handlers for activate_module, deactivate_module, and install_module. These functions are intended to be used by administrators but lack a current_user_can() check or nonce verification. As a result, any authenticated user (including Subscribers) can call these functions via POST requests.

The plugin maintains a pre-defined list of YITH plugins (e.g., YITH WooCommerce Wishlist, YITH WooCommerce Ajax Search). The attacker can only interact with plugins on this list, but this still allows unauthorized activation/deactivation of legitimate YITH plugins or installation of new ones from the YITH repository.

Attack Flow:

1. Attacker logs in as a Subscriber.
2. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=activate_module and module_slug=some-yith-plugin.
3. The plugin activates the specified module without checking capabilities.
4. The attacker can repeat for deactivation or installation.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.34.0):

add_action('wp_ajax_activate_module', 'activate_module_callback');
function activate_module_callback() {
    // No capability check
    $module_slug = $_POST['module_slug'];
    // ... activate logic
}

Patched Code (hypothetical fix):

add_action('wp_ajax_activate_module', 'activate_module_callback');
function activate_module_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $module_slug = sanitize_text_field($_POST['module_slug']);
    // ... activate logic
}

The patch adds a current_user_can('manage_options') check to restrict access to administrators only.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with YITH Essential Kit for WooCommerce #1 <= 2.34.0.
• Valid Subscriber account credentials.

Exploitation Steps:

1. Log in as a Subscriber and obtain a valid nonce (if required) or session cookie.
2. Use a tool like curl to send the AJAX request:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=activate_module&module_slug=yith-woocommerce-wishlist" \
  --cookie "wordpress_logged_in_xxx=..."

3. Verify the plugin is activated by checking the WordPress admin dashboard or site functionality.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Detection & Response)

Detection:

• Monitor AJAX requests to admin-ajax.php with actions activate_module, deactivate_module, or install_module from non-admin users.
• Alert on multiple such requests in a short time frame.

Response:

• Immediately revoke the attacker’s session.
• Review installed/activated plugins for unauthorized changes.
• Apply the patch (if available) or disable the plugin until a fix is released.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with parameters action=activate_module, action=deactivate_module, or action=install_module.
  • Source IP addresses of authenticated users making these requests (check logs for Subscriber-level accounts).

• Host IOCs:

  • Unexpected activation of YITH plugins (e.g., YITH WooCommerce Wishlist) on sites where they were previously disabled.
  • New YITH plugins installed without admin action.

• Log IOCs:

  • WordPress debug log entries showing AJAX calls to these actions from non-admin users.

Detection Engineering

YARA Rule

rule Detect_YITH_Essential_Kit_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6799 in YITH Essential Kit for WooCommerce"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6799"
    strings:
        $ajax_action1 = "activate_module"
        $ajax_action2 = "deactivate_module"
        $ajax_action3 = "install_module"
        $wp_ajax = "wp_ajax_"
    condition:
        any of ($ajax_action*) and $wp_ajax
}

Sigma Rule

title: CVE-2024-6799 - YITH Essential Kit Unauthorized Plugin Management
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized AJAX requests to activate, deactivate, or install YITH plugins by non-admin users.
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'action=activate_module'
            - 'action=deactivate_module'
            - 'action=install_module'
    condition: selection
falsepositives:
    - Legitimate admin actions (if admin IPs are whitelisted, exclude them)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6799 - YITH Essential Kit Unauthorized Plugin Management"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; http.client_body; content:"action=activate_module" or content:"action=deactivate_module" or content:"action=install_module"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential for business operations.
2. Restrict access to the vulnerable functions by adding a capability check (see patched code above) or using a Web Application Firewall (WAF) rule to block these AJAX actions from non-admin users.
3. Monitor logs for any exploitation attempts.

Long-term Fix:

• Apply the official patch from YITH when released (currently UNKNOWN).
• Upgrade to a patched version once available.

Workaround:

• Use a WordPress security plugin to enforce role-based access to AJAX actions.
• Implement a custom mu-plugin that adds capability checks:

add_action('init', function() {
    $actions = ['activate_module', 'deactivate_module', 'install_module'];
    foreach ($actions as $action) {
        add_action("wp_ajax_$action", function() use ($action) {
            if (!current_user_can('manage_options')) {
                wp_die('Unauthorized');
            }
        }, 0);
    }
});

Valters IT
Securing Digital Frontiers