CVE-2024-8437

Executive Summary

CVE-2024-8437 is a missing capability check vulnerability in the WP Easy Gallery – WordPress Gallery Plugin for WordPress. The flaw affects all versions up to and including 4.8.5. Authenticated attackers with subscriber-level access or higher can exploit AJAX hooks (e.g., wpeg_settings and wpeg_add_gallery) to modify galleries without proper authorization. This leads to unauthorized data manipulation, potentially allowing attackers to alter gallery content, settings, or inject malicious media. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood currently, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are at risk. No official patch has been released as of the analysis date. Organizations should monitor the plugin’s update channel and consider temporary removal or access restriction until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the low privileges required and the potential for unauthorized gallery modifications, which could lead to defacement or malicious content injection.

Deep Dive & Mechanics

The vulnerability stems from missing capability checks in AJAX handlers registered by the plugin. Specifically, functions like wpeg_settings and wpeg_add_gallery are hooked via WordPress AJAX actions but do not verify that the requesting user has the necessary permissions (e.g., edit_posts or manage_options). This allows any authenticated user, including subscribers, to call these endpoints and modify gallery data.

Root Cause: The plugin uses add_action('wp_ajax_wpeg_settings', 'wpeg_settings_callback') without a current_user_can() check inside the callback. Similarly, wpeg_add_gallery lacks authorization.

Impact: Attackers can:

• Change gallery titles, descriptions, or images.
• Add or remove galleries.
• Alter plugin settings (e.g., display options, permissions).
• Potentially inject malicious content (e.g., XSS via gallery descriptions).

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.8.5):

add_action('wp_ajax_wpeg_settings', 'wpeg_settings_callback');
function wpeg_settings_callback() {
    // No capability check
    update_option('wpeg_settings', $_POST['settings']);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_wpeg_settings', 'wpeg_settings_callback');
function wpeg_settings_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    update_option('wpeg_settings', $_POST['settings']);
    wp_die();
}

The patch adds a current_user_can('manage_options') check to restrict access to administrators.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WP Easy Gallery <= 4.8.5 installed.
• Valid subscriber-level account credentials.

Exploitation Steps:

1. Log in as a subscriber.
2. Craft a POST request to /wp-admin/admin-ajax.php with action wpeg_settings and malicious payload.
3. Example using cURL:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d "action=wpeg_settings&settings[gallery_title]=Hacked" \
  --cookie "wordpress_logged_in_xxx=subscriber_cookie"

Expected Outcome: The gallery settings are modified without authorization.

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with actions wpeg_settings, wpeg_add_gallery, or similar.
• Alert on requests from low-privilege users (subscriber, contributor) to these endpoints.
• Review logs for unusual gallery modifications.

Hunting:

• Search for wpeg_settings in web server access logs.
• Correlate with user role changes or suspicious activity.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=wpeg_settings or action=wpeg_add_gallery from non-admin users.
• File: Modified wp_options table entries for wpeg_settings.
• Log: WordPress debug log entries showing unauthorized AJAX calls.
• Behavior: Unexpected changes to gallery content or plugin settings.

Detection Engineering

YARA Rule

rule CVE_2024_8437_WP_Easy_Gallery {
    meta:
        description = "Detects missing capability check in WP Easy Gallery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8437"
    strings:
        $ajax_hook = /add_action\s*\(\s*['\"]wp_ajax_wpeg_/
        $no_cap_check = /function\s+\w+\s*\(\s*\)\s*\{[^}]*?(?!current_user_can)/
    condition:
        $ajax_hook and not $no_cap_check
}

Sigma Rule

title: CVE-2024-8437 - Unauthorized AJAX Access to WP Easy Gallery
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects AJAX requests to wpeg_settings or wpeg_add_gallery from low-privilege users
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - 'action=wpeg_settings'
            - 'action=wpeg_add_gallery'
    filter:
        cs-username|contains: 
            - 'admin'
            - 'editor'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions (filtered above)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-8437 - WP Easy Gallery Unauthorized AJAX Access";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=wpeg_settings"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict AJAX access via .htaccess or web application firewall (WAF) rules to block wpeg_* actions from non-admin users.
3. Audit user roles and remove unnecessary subscriber accounts.

Long-term Fix:

• Apply the vendor patch when released (add current_user_can() checks).
• Implement principle of least privilege for all AJAX handlers.

Workaround:

• Use a WordPress security plugin to add capability checks to AJAX hooks.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert