CVE-2024-12129: Royal Core Privilege Escalation Flaw

CVE-2024-12129 Overview

The Royal Core plugin for WordPress contains a missing authorization vulnerability [CWE-862] affecting all versions up to and including 2.9.2. The royal_restore_backup function lacks a capability check, allowing authenticated users with Subscriber-level access or higher to modify arbitrary WordPress options. Attackers can leverage this weakness to enable open user registration and set the default role to administrator. This chain grants full administrative control over the affected WordPress site.

Critical Impact
Any authenticated subscriber can escalate to administrator by modifying WordPress site options, resulting in complete site compromise.

Affected Products

Wp-royal-themes Royal Core plugin for WordPress
All versions up to and including 2.9.2
WordPress sites using the royal_core component

Discovery Timeline

2025-01-30 - CVE-2024-12129 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12129

Vulnerability Analysis

The vulnerability resides in the royal_restore_backup function of the Royal Core plugin. The function processes backup restoration requests without validating whether the requesting user has the required capabilities. WordPress relies on functions like current_user_can() to enforce role-based access, and the absence of such a check means any authenticated user can invoke the function.

Because the restore routine writes to the WordPress options table, an attacker can overwrite arbitrary option values. Two options are particularly valuable: users_can_register and default_role. Setting users_can_register to 1 opens registration, and setting default_role to administrator promotes newly registered users to full administrators.

The attack requires only Subscriber-level credentials, which are trivial to obtain on many WordPress sites. Once administrative access is achieved, attackers can install malicious plugins, execute arbitrary PHP, and pivot to the underlying host.

Root Cause

The root cause is a missing authorization check [CWE-862] on a privileged AJAX or admin-post handler. The royal_restore_backup function does not call current_user_can() or verify a nonce tied to an administrator capability before performing option updates.

Attack Vector

An authenticated attacker sends a crafted request to the vulnerable endpoint with a payload targeting the users_can_register and default_role options. After the options are updated, the attacker registers a new account through wp-login.php?action=register, which is automatically assigned the administrator role. The vulnerability is exploitable over the network with low attack complexity.

No verified proof-of-concept code is publicly available. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-12129

Indicators of Compromise

Unexpected changes to the users_can_register or default_role values in the WordPress wp_options table.
New administrator accounts created shortly after subscriber-level accounts were registered or authenticated.
HTTP requests to admin-ajax.php or admin-post endpoints referencing royal_restore_backup from low-privilege sessions.
Installation of unfamiliar plugins or themes following suspicious registration activity.

Detection Strategies

Audit the wp_options table for changes to registration-related keys and compare against known-good baselines.
Review WordPress user role assignments and flag any subscriber-to-administrator transitions.
Inspect web server access logs for POST requests invoking the royal_restore_backup action, especially from authenticated non-admin users.
Correlate authentication events with subsequent option modifications within short time windows.

Monitoring Recommendations

Enable WordPress activity logging to record option changes, role modifications, and plugin installations.
Alert on new administrator account creation outside of change windows.
Monitor for outbound connections initiated by PHP processes after suspicious registration events.
Track file integrity of plugins and themes to detect post-exploitation payloads.

How to Mitigate CVE-2024-12129

Immediate Actions Required

Update the Royal Core plugin to a version later than 2.9.2 once the vendor publishes a fixed release.
Audit all WordPress user accounts and remove any unauthorized administrator accounts.
Verify that users_can_register and default_role reflect the intended site configuration.
Rotate credentials for all administrator accounts and force password resets for subscribers.

Patch Information

No vendor advisory URL is available at publication time. Site owners should consult the ThemeForest Item Overview for vendor communications and apply plugin updates through the WordPress dashboard as soon as a patched build is released.

Workarounds

Deactivate and remove the Royal Core plugin until a fixed version is available.
Restrict access to wp-admin/admin-ajax.php from unauthenticated and low-privileged sessions using a web application firewall (WAF).
Set DISALLOW_FILE_MODS in wp-config.php to prevent plugin and theme installation by administrators created through exploitation.
Enforce least-privilege on subscriber-tier accounts and disable open registration where not required.

bash

# Configuration example: disable user registration and enforce safe defaults in wp-config.php
define( 'DISALLOW_FILE_MODS', true );

# Via WP-CLI, verify and reset registration settings
wp option get users_can_register
wp option update users_can_register 0
wp option update default_role subscriber