CVE-2024-1120 Overview
CVE-2024-1120 affects two WordPress plugins from XLPlugins: NextMove Lite (Thank You Page for WooCommerce) and Finale Lite (Sales Countdown Timer & Discount for WooCommerce). The download_tools_settings() function lacks a capability check in all versions up to and including 2.17.0. Unauthenticated attackers can invoke this function over the network to export plugin and system settings. The exported data can reveal configuration details useful for follow-on attacks against the WordPress site. The weakness is tracked as Missing Authorization [CWE-862].
Critical Impact
Unauthenticated remote attackers can download plugin settings and system information from affected WooCommerce sites without any user interaction.
Affected Products
- XLPlugins NextMove Lite – Thank You Page for WooCommerce (versions ≤ 2.17.0)
- XLPlugins Finale Lite – Sales Countdown Timer & Discount for WooCommerce (versions ≤ 2.17.0)
- WordPress sites running WooCommerce with either plugin installed
Discovery Timeline
- 2024-03-01 - CVE-2024-1120 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-1120
Vulnerability Analysis
The vulnerability resides in the download_tools_settings() function within the plugin's support module (wcct-xl-support.php). This function exports plugin configuration and related system information but performs no capability check before serving the data. Because WordPress registers the handler through an AJAX or admin hook accessible without authentication, any remote client can request the export. The disclosed data assists reconnaissance against the site, including plugin versions, feature flags, and environment identifiers that shape follow-on exploitation.
Root Cause
The root cause is a missing authorization control [CWE-862]. WordPress plugins must gate privileged handlers with current_user_can() checks and validate a nonce through check_ajax_referer() or equivalent. The affected function omits both controls, allowing anonymous callers to reach code intended for administrative use.
Attack Vector
An attacker sends a single unauthenticated HTTP request to the WordPress endpoint that dispatches download_tools_settings(). No credentials, session, or user interaction are required. The response contains the exported settings payload. Attackers commonly automate scans across public WordPress installations, so exposure is opportunistic and can be conducted at scale.
No verified proof-of-concept code is publicly available. Refer to the WordPress Plugin Code Review for the vulnerable function and the Wordfence Vulnerability Report for additional analysis.
Detection Methods for CVE-2024-1120
Indicators of Compromise
- Unauthenticated HTTP requests to admin-ajax.php or plugin endpoints referencing download_tools_settings or related action parameters.
- Outbound responses containing serialized plugin configuration or system information sent to unknown client IPs.
- Web server access logs showing repeated GET or POST requests to the affected plugin paths from a single source.
Detection Strategies
- Inventory WordPress installations and confirm plugin versions for NextMove Lite and Finale Lite; flag any at or below 2.17.0.
- Deploy a Web Application Firewall (WAF) rule that inspects requests targeting the download_tools_settings action and blocks unauthenticated calls.
- Correlate access log entries for the plugin paths with authentication state to surface anonymous invocations of administrative functions.
Monitoring Recommendations
- Enable verbose access logging on WordPress front-end and admin-ajax endpoints, and forward logs to a central analytics platform for retention and alerting.
- Alert on response sizes that exceed baseline for the affected endpoints, which may indicate configuration exports leaving the environment.
- Track new or updated WordPress plugins across the fleet to detect vulnerable versions reintroduced through backup restores or staging syncs.
How to Mitigate CVE-2024-1120
Immediate Actions Required
- Update NextMove Lite and Finale Lite to a version above 2.17.0 on every affected WordPress site.
- If patching cannot be performed immediately, deactivate and remove the vulnerable plugins from production sites.
- Review web server and WordPress logs for prior requests to the vulnerable endpoint and rotate any secrets that may have been exposed.
Patch Information
XLPlugins addressed the missing capability check in the plugin update tracked in the WordPress Change Log Entry. Administrators should install versions released after 2.17.0 through the WordPress plugin manager or WP-CLI.
Workarounds
- Block requests to the vulnerable endpoint at the WAF or reverse proxy until the plugin is updated.
- Restrict access to wp-admin/admin-ajax.php by IP allowlisting where operationally feasible.
- Uninstall the plugins on sites that do not require the associated WooCommerce features.
# Update the affected plugins using WP-CLI
wp plugin update nextmove-lite
wp plugin update finale-woocommerce-sales-countdown-timer-discount
# Verify the installed version is above 2.17.0
wp plugin get nextmove-lite --field=version
wp plugin get finale-woocommerce-sales-countdown-timer-discount --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
