CVE-2024-10800: Vanquish User Extra Fields Plugin Vuln

CVE-2024-10800 Overview

CVE-2024-10800 is a privilege escalation vulnerability in the Vanquish User Extra Fields plugin for WordPress. The flaw affects all plugin versions up to and including 16.6. The vulnerability stems from a missing capability check on the ajax_save_fields() function. Authenticated attackers with subscriber-level access or above can add custom fields and then abuse the check_and_overwrite_wp_or_woocommerce_fields function to update the wp_capabilities field. This lets an attacker elevate their account to administrator privileges on the affected WordPress site.

Critical Impact

Any authenticated subscriber can escalate to full administrator, granting complete control over the WordPress site, its content, users, and installed plugins.

Affected Products

• Vanquish User Extra Fields plugin for WordPress
• All versions up to and including 16.6
• WordPress sites using the User Extra Fields plugin distributed via CodeCanyon

Discovery Timeline

• 2024-11-13 - CVE-2024-10800 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10800

Vulnerability Analysis

The vulnerability is a broken access control issue [CWE-862] in the plugin's AJAX handler. The ajax_save_fields() function does not verify whether the requesting user holds the necessary capabilities to create or modify user fields. This gap allows low-privileged authenticated users to reach code paths intended for administrators.

Once an attacker can save arbitrary custom fields, the check_and_overwrite_wp_or_woocommerce_fields function processes those inputs and writes them into core WordPress user metadata. Because the routine does not restrict which meta keys can be overwritten, the attacker can target wp_capabilities. Overwriting wp_capabilities promotes the subscriber-level account to the administrator role.

Root Cause

The root cause is a missing capability check combined with unsafe handling of user-controlled field names. The AJAX endpoint relies on authentication alone rather than validating that the user has permission to manage user profiles or roles. The downstream update function trusts field names without an allowlist for reserved WordPress meta keys.

Attack Vector

Exploitation requires network access to the WordPress site and a valid low-privileged account, such as a subscriber. Many WordPress sites allow open registration for subscribers, which effectively lowers the barrier to exploitation. The attacker sends a crafted AJAX request to the vulnerable endpoint, submits a custom field named wp_capabilities, and sets its value to a serialized array granting the administrator role. No user interaction from an administrator is required.

A working exploitation flow is described in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-10800

Indicators of Compromise

• Unexpected user role changes in the wp_usermeta table, particularly on the wp_capabilities meta key for previously low-privileged accounts.
• POST requests to admin-ajax.php invoking the plugin's ajax_save_fields action from subscriber-level sessions.
• Newly created administrator accounts or existing subscribers suddenly gaining administrator access.
• WordPress audit logs showing custom fields being created that use reserved meta key names.

Detection Strategies

• Review web server access logs for repeated POST requests to /wp-admin/admin-ajax.php containing the ajax_save_fields action parameter.
• Compare current user roles against a known-good baseline and alert on any subscriber-to-administrator transitions.
• Inspect the wp_usermeta table for wp_capabilities values that were modified outside of expected administrative workflows.

Monitoring Recommendations

• Enable WordPress audit logging plugins to capture role changes, user meta updates, and plugin AJAX activity.
• Forward WordPress and web server logs to a centralized SIEM for correlation and long-term retention.
• Alert on any modification to the wp_capabilities meta key by non-administrator sessions.

How to Mitigate CVE-2024-10800

Immediate Actions Required

• Update the Vanquish User Extra Fields plugin to a version later than 16.6 as soon as a patched release is available from CodeCanyon.
• Audit all WordPress user accounts and remove any unexpected administrator accounts or role escalations.
• Disable open user registration if it is not required, or restrict the default role to prevent easy account creation.
• Rotate credentials for all administrator accounts and enforce multi-factor authentication.

Patch Information

At the time of publication, the vendor advisory is distributed through the CodeCanyon Item Overview. Site administrators should verify they are running a version newer than 16.6 and review the changelog for a fix addressing the missing capability check on ajax_save_fields().

Workarounds

• Deactivate and remove the User Extra Fields plugin until a patched version is installed.
• Deploy a Web Application Firewall (WAF) rule that blocks POST requests to admin-ajax.php with the ajax_save_fields action from non-administrator sessions.
• Restrict access to /wp-admin/admin-ajax.php at the network edge using IP allowlisting where feasible.
• Manually inspect and reset the wp_capabilities meta values for all non-administrator accounts.

# Example WAF rule concept (ModSecurity-style) to block the vulnerable AJAX action
# for non-admin sessions. Adapt to your WAF syntax and test before enforcement.
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1024010800,msg:'Block User Extra Fields ajax_save_fields abuse'"
  SecRule ARGS:action "@streq ajax_save_fields" \
    "chain"
    SecRule ARGS "@rx wp_capabilities" "t:none"