CVE-2024-7888

Executive Summary

CVE-2024-7888 is a Missing Authorization vulnerability in the Classified Listing – Classified ads & Business Directory Plugin for WordPress, affecting all versions up to and including 3.1.7. The plugin fails to perform proper capability checks on several administrative functions, including export_forms(), import_forms(), and update_fb_options(). This allows authenticated attackers with subscriber-level access or higher to modify forms, import/export data, and alter various plugin settings without authorization.

The vulnerability has a CVSS score of 6.3 (Medium), with a vector emphasizing low attack complexity and low privileges required. Although the EPSS score is currently 0.0%, the lack of a patch and the ease of exploitation (subscriber-level access) make this a significant risk for WordPress sites using the plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users should verify the integrity of their plugin files and monitor for updates from the vendor (Rtcl). No known supply chain compromise has been reported, but the unpatched status increases the risk of malicious actors injecting backdoors through the vulnerable functions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs only subscriber-level access.
• User Interaction: None (UI:N) – No victim action needed.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: High (I:H) – Forms and settings can be modified.
• Availability Impact: Low (A:L) – Potential for minor disruption.

Threat Level: Medium. The vulnerability is easy to exploit but requires authentication. However, the ability to modify forms and settings can lead to data manipulation, phishing, or further compromise.

Deep Dive & Mechanics

The vulnerability stems from missing capability checks in several functions of the classified-listing plugin. WordPress uses capability checks (e.g., current_user_can('manage_options')) to restrict administrative actions to users with sufficient privileges. In this plugin, functions like export_forms(), import_forms(), and update_fb_options() are registered via AJAX hooks without verifying the user's capabilities.

Affected Functions (non-exhaustive):

• export_forms() – Exports form configurations.
• import_forms() – Imports form configurations.
• update_fb_options() – Updates Facebook integration options.
• Additional functions for managing listings, categories, and plugin settings.

Attack Flow:

1. Attacker registers as a subscriber (or gains subscriber-level access via other means).
2. Attacker crafts AJAX requests to the vulnerable endpoints.
3. The plugin processes the request without checking if the user has administrative privileges.
4. Attacker can modify forms, import malicious configurations, or alter plugin settings.

Impact:

• Form Modification: Attacker can alter classified ad submission forms to collect sensitive data or inject malicious content.
• Settings Manipulation: Changes to plugin settings can disable security features, redirect users, or exfiltrate data.
• Data Import/Export: Importing malicious form configurations can lead to stored XSS or other attacks.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.1.7):

// Example: export_forms() without capability check
add_action('wp_ajax_rtcl_export_forms', 'rtcl_export_forms');
function rtcl_export_forms() {
    // No capability check
    $forms = get_option('rtcl_forms');
    // ... export logic
}

Patched Code (Hypothetical):

add_action('wp_ajax_rtcl_export_forms', 'rtcl_export_forms');
function rtcl_export_forms() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $forms = get_option('rtcl_forms');
    // ... export logic
}

The patch must add current_user_can('manage_options') (or a suitable capability) to all vulnerable AJAX handlers. Since no official patch is available, users must manually apply this fix or disable the plugin.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Classified Listing plugin <= 3.1.7.
• Attacker has subscriber-level credentials (e.g., username: attacker, password: password123).

Exploitation Steps:

1. Obtain Nonce (if required): Some AJAX actions may require a nonce. Extract it from the page source or use a valid session.
2. Craft AJAX Request: Use a tool like curl or Burp Suite to send a POST request to /wp-admin/admin-ajax.php.

Example: Export Forms (Unauthorized)

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=rtcl_export_forms" \
  --cookie "wordpress_logged_in_<hash>=attacker|..."

Example: Import Malicious Forms

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=rtcl_import_forms&forms=<malicious_json>" \
  --cookie "wordpress_logged_in_<hash>=attacker|..."

Expected Outcome: The attacker receives exported data or imports malicious configurations without admin privileges.

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to /wp-admin/admin-ajax.php with actions starting with rtcl_.
• Alert on requests from non-admin users to administrative actions (e.g., rtcl_export_forms, rtcl_import_forms).
• Use the Sigma rule below to detect unauthorized access attempts.

Hardening:

• Immediate: Disable the plugin if not essential.
• Code Fix: Add capability checks to all AJAX handlers (see patched code).
• WAF Rule: Block AJAX requests to rtcl_* actions from users without manage_options capability.
• User Audit: Review subscriber accounts for suspicious activity.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=rtcl_export_forms, action=rtcl_import_forms, or action=rtcl_update_fb_options.
  • Unusual JSON payloads in AJAX requests containing form configurations.

• File IOCs:

  • Modified plugin files in /wp-content/plugins/classified-listing/ (e.g., altered form definitions).
  • New files in uploads directory from imported forms.

• Log IOCs:

  • WordPress debug log entries showing AJAX calls to rtcl_* actions from subscriber-level users.
  • Web server access logs with POST /wp-admin/admin-ajax.php and HTTP_REFERER pointing to admin pages.

Detection Engineering

YARA Rule

rule CVE_2024_7888_Classified_Listing_Unauthorized_Access {
    meta:
        description = "Detects exploitation attempts of CVE-2024-7888 in Classified Listing plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7888"
    strings:
        $ajax_action = "action=rtcl_" nocase
        $export = "export_forms" nocase
        $import = "import_forms" nocase
        $fb_options = "update_fb_options" nocase
    condition:
        $ajax_action and any of ($export, $import, $fb_options)
}

Sigma Rule

title: CVE-2024-7888 - Unauthorized AJAX Access to Classified Listing Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects AJAX requests to vulnerable functions in Classified Listing plugin without proper authorization.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 
            - 'action=rtcl_export_forms'
            - 'action=rtcl_import_forms'
            - 'action=rtcl_update_fb_options'
    condition: selection
falsepositives:
    - Legitimate admin users performing these actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-7888 - Classified Listing Unauthorized AJAX Access";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=rtcl_"; http_client_body;
    content:"export_forms"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-7888;
    classtype:attempted-admin;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to business operations.
2. Apply virtual patching via WAF rules to block AJAX requests to rtcl_* actions from non-admin users.
3. Audit user accounts for any unauthorized modifications to forms or settings.

Long-Term Fix:

• The vendor (Rtcl) must release a patched version (>= 3.1.8) that adds capability checks to all AJAX handlers.
• Until then, manually patch the plugin by adding if (!current_user_can('manage_options')) { wp_die('Unauthorized'); } at the beginning of each vulnerable function.

Workaround:

• Restrict access to /wp-admin/admin-ajax.php using .htaccess or server configuration for non-admin users (may break legitimate functionality).

Monitoring:

• Enable WordPress debug logging to capture unauthorized AJAX attempts.
• Review web server logs for suspicious patterns.

Valters IT
Securing Digital Frontiers