CVE-2024-10002: Rover IDX Auth Bypass Vulnerability

CVE-2024-10002 Overview

The Rover IDX plugin for WordPress contains an authentication bypass vulnerability affecting versions up to and including 3.0.0.2905. The flaw resides in the rover_idx_refresh_social_callback function, which lacks sufficient validation and capability checks. Authenticated attackers with subscriber-level access or higher can exploit this weakness to escalate privileges and log in as an administrator. The vendor released a partial fix in version 3.0.0.2905 and a complete fix in version 3.0.0.2906. The vulnerability is tracked under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-306 (Missing Authentication for Critical Function).

Critical Impact
Any authenticated user with subscriber-level permissions can gain full administrative control over the affected WordPress site, enabling site takeover, content manipulation, and installation of malicious code.

Affected Products

Rover IDX plugin for WordPress versions up to and including 3.0.0.2905
Vendor: roveridx
WordPress installations using the Rover IDX plugin with subscriber registration enabled

Discovery Timeline

2024-10-22 - CVE-2024-10002 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10002

Vulnerability Analysis

The vulnerability originates in the rover_idx_refresh_social_callback function within the Rover IDX plugin. This callback is registered as an AJAX handler but does not enforce sufficient capability checks on the calling user. WordPress AJAX callbacks registered under wp_ajax_ are available to any authenticated user, including those holding only the default subscriber role.

Because the function proceeds without verifying whether the caller possesses administrative privileges, an attacker with even minimal authenticated access can invoke the callback and trigger logic intended for administrators. The end result is an authentication bypass that elevates a subscriber to an administrator session on the target WordPress site.

Relevant plugin source references can be reviewed in the rover-social-common.php file at line 148 and the rover-panel-social.php file at line 153.

Root Cause

The root cause is the absence of a capability check inside the rover_idx_refresh_social_callback handler. The function relies on the presence of an authenticated session but does not call current_user_can() or an equivalent authorization gate before performing privileged social-account refresh operations that ultimately establish an administrator login state.

Attack Vector

Exploitation requires network access to the WordPress site and a valid low-privilege account. On sites that allow open registration, any visitor can create a subscriber account and immediately meet the prerequisite. The attacker then issues an authenticated AJAX request to the vulnerable callback, receiving administrator-level access as a result. No user interaction from an administrator is required.

Refer to the Wordfence Vulnerability Report for additional technical context on the exploitation path.

Detection Methods for CVE-2024-10002

Indicators of Compromise

Unexpected AJAX POST requests to admin-ajax.php with the action parameter set to rover_idx_refresh_social or a related social callback name
WordPress user accounts whose roles have changed from subscriber to administrator without an audit trail
New administrator accounts created shortly after a subscriber account was registered
Installation of unfamiliar plugins or themes following suspicious login events

Detection Strategies

Inspect web server access logs for authenticated requests to admin-ajax.php invoking Rover IDX callbacks from low-privilege sessions
Monitor the WordPress wp_usermeta and wp_users tables for unexpected role changes to administrator
Correlate subscriber login events with subsequent administrative actions occurring within short time windows

Monitoring Recommendations

Enable WordPress audit logging to capture role changes, plugin installations, and administrator logins
Alert on the creation of new administrator accounts and on privilege changes affecting existing subscriber accounts
Track outbound requests from the WordPress server that follow role-elevation events, which may indicate follow-on attacker activity

How to Mitigate CVE-2024-10002

Immediate Actions Required

Upgrade the Rover IDX plugin to version 3.0.0.2906 or later, which contains the complete fix
Audit all WordPress user accounts and remove any unrecognized administrator accounts
Reset passwords for all administrator accounts and enforce multi-factor authentication
Disable open user registration if it is not required for site operation

Patch Information

The vendor released a partial patch in version 3.0.0.2905 and the full patch in version 3.0.0.2906. The corrective code change is documented in the WordPress plugin changeset 3173032, which adds proper validation and capability enforcement to the affected callback.

Workarounds

If patching is not immediately possible, deactivate the Rover IDX plugin until the update can be applied
Restrict access to admin-ajax.php from untrusted networks using a web application firewall rule targeting the vulnerable action name
Temporarily set the default new-user role to a non-existent or highly restricted value to prevent subscriber-level attackers from gaining a foothold

bash

# Configuration example: disable open registration via wp-config or WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber