CVE-2024-11951: WordPress Homey Login Privilege Escalation

CVE-2024-11951 Overview

The Homey Login Register plugin for WordPress contains a critical privilege escalation vulnerability in all versions up to and including 2.4.0. The vulnerability exists due to improper access control during the user registration process, allowing users who are registering new accounts to arbitrarily set their own role. This flaw enables unauthenticated attackers to gain elevated privileges by creating an account with the administrator role, potentially leading to complete site takeover.

Critical Impact

Unauthenticated attackers can create administrator accounts, gaining complete control over affected WordPress installations including the ability to modify content, install malicious plugins, access sensitive data, and compromise the underlying server.

Affected Products

• Homey Login Register plugin for WordPress versions up to and including 2.4.0
• WordPress sites using the Homey Booking WordPress Theme with the vulnerable plugin

Discovery Timeline

• 2025-03-05 - CVE CVE-2024-11951 published to NVD
• 2025-03-05 - Last updated in NVD database

Technical Details for CVE-2024-11951

Vulnerability Analysis

This privilege escalation vulnerability (CWE-269: Improper Privilege Management) stems from a fundamental flaw in how the Homey Login Register plugin handles user registration. The plugin fails to properly restrict role assignment during the registration process, trusting user-supplied input for a security-critical parameter.

When a new user registers through the plugin, the registration form or API endpoint accepts a role parameter that directly influences the WordPress user role assigned to the new account. Under normal circumstances, WordPress restricts new user registrations to the default role configured by the site administrator (typically "Subscriber"). However, the Homey Login Register plugin bypasses this security control by allowing the registering user to specify their desired role.

The absence of server-side validation for the role parameter means that an attacker can submit a registration request with role=administrator (or the equivalent role identifier), and the plugin will create the account with full administrative privileges. This represents a complete authentication bypass to the administrative functions of the WordPress site.

Root Cause

The root cause is improper privilege management during user registration. The plugin accepts user-controlled input for role assignment without validating whether the requesting user has authorization to assign that role. This violates the principle of least privilege and represents a broken access control vulnerability. The plugin should either:

1. Ignore any user-supplied role parameter entirely
2. Validate that the requesting user has capability to assign the specified role
3. Restrict registration to only the default WordPress user role

Attack Vector

The attack can be executed remotely over the network without any authentication or user interaction. An attacker simply needs to identify a WordPress site running a vulnerable version of the Homey Login Register plugin and submit a crafted registration request.

The attack flow typically involves:

1. Identifying target WordPress sites using the Homey theme or plugin through fingerprinting
2. Locating the registration endpoint exposed by the plugin
3. Submitting a registration request with a manipulated role parameter set to "administrator"
4. Using the newly created administrator account to log in and take control of the site

No special tools or exploits are required—the attack can be performed using standard HTTP requests or even through the registration form if it exposes the role field.

Detection Methods for CVE-2024-11951

Indicators of Compromise

• Unexpected administrator accounts appearing in the WordPress user list
• New user accounts with administrative privileges that were not created by known administrators
• Registration activity from suspicious IP addresses or geographic locations
• User accounts with unusual usernames or email patterns (common in automated attacks)
• Audit log entries showing administrator account creation without corresponding legitimate admin activity

Detection Strategies

• Monitor WordPress user table for newly created accounts with wp_capabilities containing administrator role
• Implement real-time alerting on any new administrator account creation
• Deploy Web Application Firewall (WAF) rules to detect and block registration requests containing role manipulation attempts
• Review HTTP POST requests to registration endpoints for anomalous role parameters
• Use WordPress security plugins with user monitoring capabilities to track privilege changes

Monitoring Recommendations

• Enable comprehensive WordPress audit logging including user registration events
• Configure alerts for any administrator-level account creation
• Monitor plugin directory for the presence and version of Homey Login Register
• Implement network-level logging to capture registration requests for forensic analysis
• Regularly audit the WordPress user database for unauthorized privileged accounts

How to Mitigate CVE-2024-11951

Immediate Actions Required

• Update the Homey Login Register plugin to the latest patched version immediately
• Audit all existing WordPress user accounts for unauthorized administrators created after the plugin was installed
• Remove any suspicious administrator accounts that cannot be attributed to legitimate creation
• Consider temporarily disabling user registration if an update is not immediately available
• Review WordPress audit logs for evidence of exploitation

Patch Information

Administrators should update the Homey Login Register plugin to the latest version available through the ThemeForest marketplace or WordPress plugin repository. For detailed vulnerability information and remediation guidance, refer to the Wordfence Vulnerability Report.

Workarounds

• Disable user registration entirely through WordPress Settings → General → Membership if registration is not a business requirement
• Remove or deactivate the Homey Login Register plugin until a patched version is available
• Implement a Web Application Firewall rule to filter registration requests containing role parameters
• Use a WordPress security plugin to restrict registration capabilities and monitor for suspicious account creation
• If registration must remain enabled, implement additional server-side validation through custom code or security plugins

# Disable WordPress registration via wp-config.php as temporary mitigation
# Add to wp-config.php before "That's all, stop editing!"
define('DISALLOW_FILE_EDIT', true);

# Or disable registration via WP-CLI
wp option update users_can_register 0

# Audit for suspicious administrator accounts
wp user list --role=administrator --format=table