CVE-2024-11848: NitroPack WordPress Auth Bypass Vulnerability

CVE-2024-11848 Overview

The NitroPack plugin for WordPress contains a missing authorization vulnerability in the nitropack_dismiss_notice_forever AJAX action. Versions up to and including 1.17.0 fail to perform a capability check before updating site options. Authenticated attackers holding subscriber-level access or higher can set arbitrary WordPress options to the fixed value 1. This allows adversaries to enable dangerous settings such as public user registration or corrupt options that cause a denial of service. The weakness is classified as Missing Authorization [CWE-862].

Critical Impact
Any authenticated user can toggle site-wide WordPress options, enabling account creation abuse and denial of service against affected sites.

Affected Products

NitroPack plugin for WordPress, all versions through 1.17.0
WordPress sites permitting subscriber-level registrations with NitroPack installed
Any WordPress deployment where the vulnerable plugin remains active

Discovery Timeline

2025-01-15 - CVE-2024-11848 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11848

Vulnerability Analysis

The NitroPack plugin registers an AJAX endpoint named nitropack_dismiss_notice_forever intended to permanently dismiss administrative notices. The handler accepts a caller-supplied option name and writes the value 1 into the corresponding WordPress option using update_option. Because the plugin does not verify the requesting user's capabilities, any authenticated account, including subscribers, can invoke the endpoint and mutate site configuration.

WordPress exposes numerous security-sensitive options that accept 1 as a meaningful value. Setting users_can_register to 1 opens public registration. Setting blog_public to 1 alters indexing behavior. Overwriting options that expect serialized data or specific formats with the literal integer 1 breaks plugin and theme behavior, producing denial of service conditions across the site.

Root Cause

The root cause is the absence of a current_user_can() capability check and, in the vulnerable code path, insufficient nonce enforcement tied to a privileged role. The AJAX action was registered with wp_ajax_ rather than gated behind an administrative capability, so any logged-in user can reach the handler. The handler additionally trusts the client-supplied option name without an allowlist.

Attack Vector

Exploitation requires an authenticated session at the subscriber level or above. The attacker sends a POST request to /wp-admin/admin-ajax.php with action=nitropack_dismiss_notice_forever and an option parameter naming the WordPress option to overwrite. The server responds by writing 1 into that option. No user interaction from an administrator is required. See the Wordfence Vulnerability Analysis and the WordPress Changeset for NitroPack for the patched implementation.

Detection Methods for CVE-2024-11848

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=nitropack_dismiss_notice_forever originating from non-administrative user sessions
Unexpected changes to users_can_register, default_role, or other core WordPress options set to the literal value 1
Sudden appearance of new low-privilege WordPress accounts following the option change
Site-wide errors or broken plugin behavior consistent with corrupted option values

Detection Strategies

Audit the wp_options table for options whose values were recently overwritten to 1 and compare against known-good backups
Enable WordPress action logging to capture the updated_option hook and correlate with the requesting user identity
Alert on admin-ajax.php calls to nitropack_dismiss_notice_forever where the requesting user lacks the manage_options capability

Monitoring Recommendations

Forward WordPress and web server access logs to a centralized analytics pipeline for retention and query
Track option modification events and new user registrations as high-priority signals on production sites
Baseline normal administrative behavior and alert on subscriber accounts issuing AJAX actions reserved for administrators

How to Mitigate CVE-2024-11848

Immediate Actions Required

Update the NitroPack plugin to a version later than 1.17.0 on every WordPress site in the estate
Review wp_options for tampered values, restore correct values, and verify users_can_register is set as intended
Audit user accounts created after the earliest suspicious AJAX activity and remove any unauthorized accounts
Rotate credentials for accounts that may have been elevated through configuration changes

Patch Information

The maintainers addressed the missing authorization check in the plugin's AJAX handler. Review the fix in the WordPress Changeset for NitroPack. Install the fixed release through the WordPress plugin updater or by deploying the updated plugin package across managed sites.

Workarounds

Deactivate the NitroPack plugin until the patched version is installed on the site
Restrict subscriber-level registration on public sites where user self-registration is not required
Use a web application firewall rule to block requests to admin-ajax.php with action=nitropack_dismiss_notice_forever from non-administrator sessions

bash

# Configuration example: disable open registration until patched
wp option update users_can_register 0
wp plugin deactivate nitropack
wp plugin update nitropack