CVE-2024-11725 Overview
CVE-2024-11725 affects the SMS Alert Order Notifications – WooCommerce plugin for WordPress, developed by Cozyvision. The vulnerability exists in the updateWcWarrantySettings() function through version 3.7.6. The function lacks a capability check, allowing authenticated users with subscriber-level access or higher to update arbitrary WordPress options. Attackers can change the default registration role to administrator and enable open user registration, gaining full administrative access to the site. Exploitation requires the woocommerce-warranty plugin to be installed alongside the vulnerable SMS Alert plugin.
Critical Impact
Authenticated subscribers can escalate to administrator by modifying WordPress options, resulting in complete site takeover.
Affected Products
- Cozyvision SMS Alert Order Notifications – WooCommerce plugin for WordPress
- All versions up to and including 3.7.6
- Sites also running the woocommerce-warranty plugin
Discovery Timeline
- 2025-01-07 - CVE-2024-11725 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11725
Vulnerability Analysis
The vulnerability is a Missing Authorization flaw classified as [CWE-862]. It resides in the updateWcWarrantySettings() function inside helper/return-warranty.php. The function processes AJAX requests to update warranty-related settings but does not verify the caller's WordPress capabilities. Any authenticated user, including subscribers, can invoke the handler and pass arbitrary option names and values. Because the handler ultimately calls WordPress option update functions without restricting keys to warranty settings, attackers can modify security-sensitive options such as default_role and users_can_register.
Root Cause
The root cause is the absence of a current_user_can() check and a missing nonce validation on the settings update handler. WordPress relies on plugin authors to enforce capability checks on privileged actions. The updateWcWarrantySettings() function accepts option keys and values from the request body and writes them directly, treating any authenticated session as trusted. This creates a broken access control condition allowing horizontal-to-vertical privilege escalation.
Attack Vector
The attack requires network access and a low-privileged authenticated account such as a subscriber. Many WooCommerce sites permit open customer registration, providing attackers with easy access to subscriber accounts. Once authenticated, the attacker sends a crafted request to the AJAX endpoint that reaches updateWcWarrantySettings(), setting default_role to administrator and users_can_register to 1. The attacker then registers a new account through the standard WordPress registration page, which is automatically assigned administrator privileges. Full site takeover follows, including plugin and theme file editing, database access, and arbitrary code execution through the admin dashboard.
See the WordPress SMS Alert Code reference and the Wordfence Vulnerability Report for the vulnerable code path.
Detection Methods for CVE-2024-11725
Indicators of Compromise
- Unexpected changes to the default_role and users_can_register values in the wp_options table.
- New administrator accounts created shortly after low-privileged user activity or self-registration events.
- POST requests from subscriber sessions targeting AJAX handlers referenced in sms-alert/helper/return-warranty.php.
- Modifications to plugin or theme files performed by newly created admin accounts.
Detection Strategies
- Audit the wp_options table for recent changes to registration-related options and compare against known-good values.
- Review WordPress user logs for account role promotions and new administrator accounts created by non-admin actors.
- Inspect web server access logs for authenticated POST requests to admin-ajax.php invoking warranty-related actions from subscriber accounts.
- Correlate registration events with subsequent privileged actions such as plugin installation or file editing.
Monitoring Recommendations
- Enable WordPress audit logging plugins to record role changes, option updates, and user creation events.
- Forward WordPress and web server logs to a central SIEM for behavioral correlation and long-term retention.
- Alert on any modification to the default_role option, which should rarely change in production environments.
How to Mitigate CVE-2024-11725
Immediate Actions Required
- Update the SMS Alert Order Notifications – WooCommerce plugin to a version later than 3.7.6.
- Audit all WordPress user accounts and remove any unauthorized administrator accounts.
- Verify that default_role is set to subscriber and confirm the intended value of users_can_register.
- Rotate credentials for all administrator accounts and invalidate active sessions.
Patch Information
The vendor addressed the vulnerability through changesets published on the WordPress plugin repository. Review the fix in the WordPress SMS Alert Changeset and follow-up commits 3197777, 3199795, and 3207391. The patch adds a capability check to restrict the settings update handler to authorized administrators.
Workarounds
- Deactivate the SMS Alert Order Notifications plugin until patching is possible.
- Deactivate the woocommerce-warranty plugin, as exploitation requires it to be installed.
- Disable open user registration by setting users_can_register to 0 in WordPress general settings.
- Restrict access to admin-ajax.php from untrusted networks using a web application firewall rule targeting warranty-related actions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
