CVE-2024-9519

Executive Summary

CVE-2024-9519 is a privilege escalation vulnerability in the UserPlus WordPress plugin (versions up to and including 2.0). The flaw resides in the save_metabox_form function, which lacks a proper capability check. This allows authenticated attackers with at least Editor-level permissions to modify the registration form role to Administrator. Consequently, any new user registering through the compromised form will be granted Administrator privileges, leading to full site takeover.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx. The CVSS score is 7.2 (High), and while the EPSS score is currently 0.0%, the impact is severe due to the ease of exploitation once an attacker has Editor access.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. There is no NPM, PyPI, Go, or Ruby package involved. The risk is primarily to WordPress site administrators who have installed the UserPlus plugin. The lack of a patch from the vendor (Userplus) means sites must rely on temporary mitigations or removal of the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N) – The attacker can exploit this remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: High (PR:H) – Requires Editor-level or above authentication.
• User Interaction: None (UI:N) – No victim action needed.
• Scope: Unchanged (S:U) – The vulnerable component and impacted component are the same.
• Confidentiality Impact: High (C:H) – Full site data access.
• Integrity Impact: High (I:H) – Ability to modify site content and settings.
• Availability Impact: High (A:H) – Potential for site defacement or denial of service.

Threat Level: High. While the attacker needs Editor-level access, this is often achievable through other vulnerabilities (e.g., XSS, weak passwords) or by compromising a lower-privileged account. Once exploited, the attacker gains full administrative control.

Deep Dive & Mechanics

The vulnerability is in the save_metabox_form function within the UserPlus plugin. This function is responsible for saving the registration form settings, including the default role assigned to new users. The function is hooked to an AJAX action or a POST request, but it does not verify that the current user has the manage_options capability (required for Administrator-level changes). Instead, it only checks for edit_posts or similar Editor-level capabilities.

Attack Flow:

1. An attacker with Editor-level access (or higher) logs into the WordPress admin panel.
2. The attacker sends a crafted POST request to the endpoint that triggers save_metabox_form, setting the role parameter to administrator.
3. The plugin saves this setting without proper authorization.
4. Any new user who registers via the UserPlus registration form is automatically assigned the Administrator role.
5. The attacker can then create a new account (or use an existing one) to gain full administrative privileges.

Root Cause: Missing capability check (current_user_can('manage_options')) in the save_metabox_form function.

Vulnerable vs. Patched Code

The following is a conceptual representation based on the vulnerability description. Actual plugin code may vary.

Vulnerable Code (UserPlus <= 2.0):

function save_metabox_form() {
    // No capability check
    if (isset($_POST['role'])) {
        update_option('userplus_registration_role', sanitize_text_field($_POST['role']));
    }
    // ... other save logic
}

Patched Code (Hypothetical):

function save_metabox_form() {
    // Proper capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    if (isset($_POST['role'])) {
        update_option('userplus_registration_role', sanitize_text_field($_POST['role']));
    }
    // ... other save logic
}

The patched version adds a current_user_can('manage_options') check, ensuring only Administrators can modify the registration role.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with UserPlus plugin version <= 2.0 installed and activated.
• An authenticated session with Editor-level privileges (or higher).

Exploitation Steps:

1. Identify the vulnerable endpoint. The save_metabox_form function is typically triggered via a POST request to /wp-admin/admin-ajax.php with an action parameter.

2. Craft the exploit request. Using a tool like curl or Burp Suite, send the following request:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=save_metabox_form&role=administrator' \
  --cookie 'wordpress_logged_in_...=...'

3. Verify the change. Register a new user via the UserPlus registration form. The new user should be assigned the Administrator role.

4. Escalate privileges. Log in as the newly created Administrator account to take full control of the site.

Note: The exact action name may vary. Use browser developer tools to inspect the AJAX request when saving the registration form in the admin panel.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual changes to the userplus_registration_role option in the database.
• Alert on any POST requests to admin-ajax.php with an action parameter related to UserPlus (e.g., save_metabox_form) from non-Administrator users.
• Review user registration logs for accounts created with Administrator role that were not explicitly assigned.

Hardening:

• Immediately disable or remove the UserPlus plugin until a patch is available.
• Restrict Editor-level accounts to the minimum necessary permissions.
• Implement Web Application Firewall (WAF) rules to block requests to admin-ajax.php with suspicious parameters from non-Administrator users.
• Enable two-factor authentication (2FA) for all accounts with Editor-level or higher privileges.

Indicators of Compromise (IOCs)

• Database Option: userplus_registration_role set to administrator.
• Log Entries: Unusual AJAX requests to /wp-admin/admin-ajax.php with action save_metabox_form from Editor-level users.
• User Accounts: New user accounts with Administrator role created via the registration form.
• File Changes: No specific file changes, but the plugin's save_metabox_form function may be called without proper authorization.

Detection Engineering

YARA Rule

rule CVE_2024_9519_UserPlus_PrivEsc {
    meta:
        description = "Detects vulnerable UserPlus plugin code with missing capability check"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9519"
    strings:
        $func = "function save_metabox_form" nocase
        $update = "update_option('userplus_registration_role'" nocase
        $no_check = "current_user_can" nocase
    condition:
        $func and $update and not $no_check
}

Sigma Rule

title: CVE-2024-9519 UserPlus Privilege Escalation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized modification of UserPlus registration role by non-admin users
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=save_metabox_form'
        cs-uri-query|contains: 'role=administrator'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-9519 UserPlus Privilege Escalation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=save_metabox_form"; http_client_body;
    content:"role=administrator"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the UserPlus plugin until a patched version is released.
2. Audit all user accounts with Editor-level or higher privileges for signs of compromise.
3. Review user registration logs for any accounts created with Administrator role.

Long-term Fix:

• The vendor (Userplus) must release a patched version that adds a proper capability check (current_user_can('manage_options')) to the save_metabox_form function.
• Until then, consider using an alternative registration plugin.

Workaround:

• Implement a custom function in the theme's functions.php to override the vulnerable behavior:

add_action('admin_init', function() {
    if (current_user_can('editor') && isset($_POST['save_metabox_form'])) {
        wp_die('You do not have permission to perform this action.');
    }
});

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert