CVE-2024-9872

Executive Summary

CVE-2024-9872 is a Missing Authorization vulnerability in the WordPress plugin Online Booking & Scheduling Calendar for WordPress by vcita (versions up to and including 4.5.1). The flaw resides in the vcita_save_user_data_callback() function, which lacks a capability check. This allows authenticated attackers with Subscriber-level access or higher to inject malicious web scripts and update arbitrary plugin settings. The vulnerability has a CVSS score of 5.4 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code has been released.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package. The supply chain risk is limited to the plugin's update mechanism; users should ensure they update to a patched version once available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Requires Subscriber-level authentication.
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Unchanged (U) - Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) - Limited data exposure possible.
• Integrity (I): Low (L) - Limited data modification possible.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the ability to inject scripts and modify settings poses a significant risk to site integrity and user trust.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) in the WordPress plugin's AJAX handler. The function vcita_save_user_data_callback() is registered as an AJAX action for both authenticated and unauthenticated users. However, the code fails to verify that the current user has the necessary capabilities (e.g., manage_options or edit_posts) before processing the request.

Root Cause: The function vcita_save_user_data_callback() does not call current_user_can() or any other authorization check. This allows any authenticated user, including Subscribers, to:

1. Update arbitrary plugin settings (e.g., API keys, scheduling preferences).
2. Inject malicious JavaScript or HTML into plugin settings fields, leading to Stored Cross-Site Scripting (XSS) when an administrator views the settings page.

Attack Flow:

1. Attacker authenticates as a Subscriber.
2. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=vcita_save_user_data and malicious payloads in the data fields.
3. The plugin saves the attacker-controlled data without validation.
4. When an administrator accesses the plugin settings page, the injected script executes in their browser context.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.5.1):

add_action('wp_ajax_vcita_save_user_data', 'vcita_save_user_data_callback');
function vcita_save_user_data_callback() {
    // No capability check
    $user_data = $_POST['user_data'];
    update_option('vcita_user_data', $user_data);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_vcita_save_user_data', 'vcita_save_user_data_callback');
function vcita_save_user_data_callback() {
    // Added capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $user_data = sanitize_text_field($_POST['user_data']);
    update_option('vcita_user_data', $user_data);
    wp_die();
}

The patched version adds a capability check (current_user_can('manage_options')) and input sanitization (sanitize_text_field()).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with vcita plugin <= 4.5.1.
• Valid Subscriber account credentials.

Exploitation Steps:

1. Log in as a Subscriber.
2. Craft a POST request to inject malicious JavaScript:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=vcita_save_user_data&user_data[setting_name]=<script>alert('XSS')</script>"

3. The script is stored in the plugin settings.
4. When an admin visits the plugin settings page, the script executes.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with action=vcita_save_user_data from non-admin users.
2. Review plugin settings for unexpected changes or script tags.
3. Check WordPress user roles for unauthorized privilege escalation.

Response:

1. Immediately disable the vcita plugin if no patch is available.
2. Remove any injected scripts from the wp_options table (option name vcita_user_data).
3. Reset all user passwords if admin accounts were compromised.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=vcita_save_user_data from low-privilege users.
  • Unusual parameters in the request body containing <script> tags or base64-encoded payloads.

• Host IOCs:

  • Modified wp_options table entry for vcita_user_data containing unexpected HTML/JavaScript.
  • Plugin settings page displaying unexpected content or alerts.

• File IOCs:

  • No file-based IOCs as the vulnerability is data-only.

Detection Engineering

YARA Rule

rule CVE_2024_9872_WordPress_vcita_XSS {
    meta:
        description = "Detects exploitation attempts of CVE-2024-9872 in WordPress vcita plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-9872"
    strings:
        $ajax_action = "vcita_save_user_data"
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $wp_admin_ajax = "admin-ajax.php"
    condition:
        $ajax_action and $xss_payload and $wp_admin_ajax
}

Sigma Rule

title: CVE-2024-9872 WordPress vcita Plugin XSS Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to admin-ajax.php with vcita_save_user_data action and script tags
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: 
            - '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=vcita_save_user_data'
        cs-uri-query|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate plugin updates (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-9872 WordPress vcita Plugin XSS Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=vcita_save_user_data";
    http_client_body;
    content:"<script";
    http_client_body;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review and sanitize the vcita_user_data option in the database.
3. Audit user roles and remove any suspicious Subscriber accounts.

Long-term Fix:

• Apply the vendor patch once available (check the WordPress plugin repository for updates).
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=vcita_save_user_data from non-admin users.

Workaround:

• Add a capability check via a custom plugin or theme functions.php:

add_action('wp_ajax_vcita_save_user_data', 'custom_vcita_auth_check', 1);
function custom_vcita_auth_check() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}

Valters IT
Securing Digital Frontiers