CVE-2024-7836

Executive Summary

CVE-2024-7836 is a vulnerability in the Themify Builder plugin for WordPress, affecting all versions up to and including 7.6.1. The flaw resides in the duplicate_page_ajaxify function, which lacks proper authorization checks. This allows authenticated attackers with Contributor-level access or higher to duplicate and view private or draft posts created by other users, bypassing intended access controls. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept (PoC) or exploit code has been released. As a WordPress plugin issue, this vulnerability is specific to the WordPress ecosystem and does not involve server-level components like Apache or Nginx.

Supply Chain & Package Security

This vulnerability is specific to the Themify Builder plugin, a third-party WordPress plugin. No supply chain implications (e.g., compromised packages in NPM, PyPI, Go, or Ruby) have been identified. The risk is limited to WordPress sites using the affected plugin version.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (unauthorized access to private/draft posts)
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Medium. The vulnerability allows information disclosure but requires authenticated access. No active exploitation has been observed.

Deep Dive & Mechanics

The vulnerability exists in the duplicate_page_ajaxify function within the Themify Builder plugin. This function is intended to allow users to duplicate posts/pages via AJAX requests. However, it fails to verify that the authenticated user has permission to access the original post being duplicated. Specifically, the function does not check if the user can read private or draft posts authored by other users. As a result, an attacker with Contributor-level access can craft a request to duplicate any post, including those that are private or in draft status, and then view the duplicated content. The attack is performed via a POST request to the WordPress admin-ajax.php endpoint with the appropriate action parameter.

Vulnerable vs. Patched Code

Vulnerable Code (Themify Builder <= 7.6.1): The duplicate_page_ajaxify function likely contains a call to get_post() or similar without verifying the user's capabilities. For example:

function duplicate_page_ajaxify() {
    $post_id = intval($_POST['post_id']);
    $post = get_post($post_id);
    // No capability check before duplication
    // ...
}

Patched Code (Hypothetical): A patch would add a capability check, such as:

function duplicate_page_ajaxify() {
    $post_id = intval($_POST['post_id']);
    $post = get_post($post_id);
    if (!current_user_can('read_post', $post_id)) {
        wp_die('Unauthorized');
    }
    // ...
}

No official patch has been released as of this analysis.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker with Contributor-level access can send a crafted POST request to the WordPress admin-ajax.php endpoint. Example using cURL:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=themify_builder_duplicate_page&post_id=123" \
  --cookie "wordpress_logged_in_xxx=attacker_session_cookie"

Replace 123 with the ID of a private or draft post. The response will contain the duplicated post data, which can then be viewed.

Blue Team

To detect exploitation attempts, monitor for unusual AJAX requests to admin-ajax.php with the action themify_builder_duplicate_page from users with low privileges (e.g., Contributor). Also, log and alert on any duplication of posts that are private or draft by users who are not the original author.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with parameter action=themify_builder_duplicate_page and a post_id parameter.
• Logs: WordPress debug logs showing unauthorized post duplication attempts.
• File: No specific file-based IOCs; the vulnerability is logic-based.

Detection Engineering

YARA Rule

rule Detect_Themify_Builder_Vulnerability {
    meta:
        description = "Detects exploitation attempts for CVE-2024-7836 in Themify Builder"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $ajax_action = "themify_builder_duplicate_page"
        $post_id = "post_id"
    condition:
        $ajax_action and $post_id
}

Sigma Rule

title: Detection of CVE-2024-7836 Exploitation Attempts
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to admin-ajax.php with the action themify_builder_duplicate_page
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: 
            - "admin-ajax.php"
        cs-uri-query|contains: "action=themify_builder_duplicate_page"
    condition: selection
falsepositives:
    - Legitimate use by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7836 - Themify Builder Duplicate Page Exploit"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=themify_builder_duplicate_page"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Themify Builder plugin if not essential, or restrict Contributor-level access to trusted users only.
2. Short-term: Monitor for plugin updates from Themify. Apply the patch as soon as it becomes available.
3. Long-term: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with the themify_builder_duplicate_page action from non-admin users. Regularly audit user permissions and plugin vulnerabilities.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert