CVE-2024-11334: My Contador Lesr Auth Bypass Vulnerability

CVE-2024-11334 Overview

The My Contador lesr plugin for WordPress contains a missing authorization vulnerability [CWE-862] in the exportar_registros() function. All versions up to and including 2.0 fail to enforce a capability check before exporting stored records. Unauthenticated attackers can invoke the export routine over the network and retrieve user data collected by the plugin.

The issue was published to the National Vulnerability Database on 2024-11-21 and last updated on 2026-06-17. Wordfence tracks the flaw under advisory ID 82cfeff9-7079-408e-9c22-bae0d45000ed.

Critical Impact
Remote, unauthenticated actors can export user records from any WordPress site running the vulnerable my-contador-wp plugin, exposing collected data without any user interaction.

Affected Products

Nes360 My Contador lesr plugin for WordPress, versions up to and including 2.0
WordPress installations with my-contador-wp active
CPE: cpe:2.3:a:nes360:my_contador_lesr:*:*:*:*:*:wordpress:*:*

Discovery Timeline

2024-11-21 - CVE-2024-11334 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11334

Vulnerability Analysis

The My Contador lesr plugin exposes an exportar_registros() function that returns stored counter records. The function is registered as a WordPress action handler but does not verify the caller's identity or capabilities. Any HTTP client that reaches the exposed endpoint can trigger the export and receive the resulting data.

Because the endpoint requires no authentication, no privileges, and no user interaction, exploitation is trivial once the plugin is identified on a target site. The impact is limited to confidentiality of the records the plugin collects; integrity and availability of the site are not affected. The exposed data may include visitor identifiers or other records the site owner configured the counter to store.

Root Cause

The root cause is a missing capability check inside exportar_registros() in contador.php. The handler proceeds directly to record retrieval without calling current_user_can() or validating a nonce. Reviewers can inspect the pre-patch source in the WordPress Plugin Code Review.

Attack Vector

Exploitation occurs over the network against the WordPress AJAX or admin-post endpoint that dispatches the vulnerable action. An unauthenticated attacker issues a single HTTP request naming the export action; the plugin responds with the exported records. No credentials, tokens, or victim interaction are required, and the request can be automated at scale against sites fingerprinted as running my-contador-wp.

The fix landed in the plugin repository under WordPress Changeset 3191748, which adds an authorization check to the export handler.

Detection Methods for CVE-2024-11334

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to wp-admin/admin-ajax.php or wp-admin/admin-post.php referencing the exportar_registros action
Outbound responses from the WordPress site containing bulk record exports served without a valid session cookie
Repeated access to plugin paths under /wp-content/plugins/my-contador-wp/ from a single source IP

Detection Strategies

Alert on requests to admin-ajax.php where the action parameter matches exportar_registros and no authenticated WordPress cookie is present
Review web server access logs for anomalous response sizes tied to the plugin's action names
Correlate plugin inventory data with vulnerable version ranges (≤ 2.0) to identify exposed hosts

Monitoring Recommendations

Ingest WordPress access logs into a centralized log platform and build detections for unauthenticated administrative actions
Track user-agent strings and source IPs that enumerate /wp-content/plugins/ directories
Monitor for spikes in outbound response size from WordPress endpoints associated with the plugin

How to Mitigate CVE-2024-11334

Immediate Actions Required

Update the My Contador lesr plugin to the version published in WordPress Changeset 3191748
If an update is not immediately possible, deactivate and remove the my-contador-wp plugin from all WordPress installations
Review plugin-collected records to determine whether any data was exported without authorization

Patch Information

The vendor addressed the missing capability check in the changeset referenced above. Site administrators should install the fixed release from the WordPress plugin repository and confirm the plugin version in wp-admin reflects the patched build. Details of the underlying code change and the vulnerability scope are documented in the Wordfence Vulnerability Report.

Workarounds

Block unauthenticated requests to admin-ajax.php where action=exportar_registros using a web application firewall rule
Restrict access to /wp-admin/ endpoints by source IP where operationally feasible
Disable the plugin until the patched version is deployed across all environments

bash

# Example WAF rule concept (ModSecurity-style) to block the vulnerable action
SecRule ARGS:action "@streq exportar_registros" \
    "id:1011334,phase:2,deny,status:403,\
    msg:'Block CVE-2024-11334 unauthenticated export attempt',\
    chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"