CVE-2024-12202 Overview
The Croma Music plugin for WordPress contains a missing authorization vulnerability in the ironMusic_ajax function. All versions up to and including 3.6 are affected. The flaw allows authenticated attackers with Subscriber-level access or higher to update arbitrary WordPress options. Attackers can modify the default_role option to administrator and enable open registration through the users_can_register option. This chain lets attackers register new accounts that automatically receive administrator privileges, leading to full site takeover. The vulnerability maps to CWE-862: Missing Authorization.
Critical Impact
Any Subscriber-level user can escalate to full WordPress administrator by abusing the missing capability check in ironMusic_ajax.
Affected Products
- Croma Music plugin for WordPress — all versions ≤ 3.6
- WordPress sites running the Croma theme bundled with the vulnerable plugin
- Any installation exposing the plugin's ironMusic_ajax AJAX endpoint
Discovery Timeline
- 2025-01-07 - CVE-2024-12202 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12202
Vulnerability Analysis
The Croma Music plugin registers an AJAX action handled by the ironMusic_ajax function. This handler processes requests that update WordPress site options through the update_option API. The handler does not verify the caller's capabilities using current_user_can and does not enforce a nonce-scoped authorization check.
Because WordPress AJAX endpoints registered under wp_ajax_* are accessible to any authenticated user, a Subscriber can invoke the endpoint directly. The handler then writes attacker-supplied values to option keys stored in the wp_options table. Two options are particularly dangerous: default_role, which controls the role assigned to new registrations, and users_can_register, which toggles open registration.
An attacker with a Subscriber account issues an AJAX request to set users_can_register to 1 and default_role to administrator. The attacker then registers a new account through /wp-login.php?action=register. The new account inherits administrator privileges, granting full control over the site, including plugin installation, arbitrary PHP execution, and database access.
Root Cause
The root cause is a missing authorization check [CWE-862] inside the ironMusic_ajax function. The handler trusts the authenticated session without validating that the caller holds manage_options or an equivalent capability before writing to arbitrary option keys.
Attack Vector
Exploitation requires network access to the WordPress site and a valid low-privileged account. Registration on many WordPress installations is open by default for Subscriber accounts. The attacker sends a crafted POST to /wp-admin/admin-ajax.php invoking the ironMusic_ajax action with option-key and option-value parameters, then completes registration to gain administrative access.
No verified proof-of-concept code is published. See the Wordfence Vulnerability Report and the Croma Changelog File for vendor-side details.
Detection Methods for CVE-2024-12202
Indicators of Compromise
- Unexpected changes to default_role or users_can_register values in the wp_options table
- New administrator accounts created shortly after a Subscriber registration or login event
- POST requests to /wp-admin/admin-ajax.php containing action=ironMusic_ajax from low-privileged sessions
- Plugin or theme installations initiated by newly created accounts
Detection Strategies
- Alert on any modification of sensitive wp_options keys, including default_role, users_can_register, siteurl, and home
- Correlate low-privileged authentication events with subsequent administrator account creation within short time windows
- Monitor web server logs for AJAX calls to the ironMusic_ajax action originating from Subscriber sessions
Monitoring Recommendations
- Enable WordPress audit logging for user role changes, option updates, and registration configuration changes
- Forward web server and PHP-FPM logs to a central log platform and retain them for at least 90 days
- Baseline expected administrator account counts and alert on deviations
How to Mitigate CVE-2024-12202
Immediate Actions Required
- Deactivate and remove the Croma Music plugin until a patched version is verified installed
- Audit the wp_users and wp_usermeta tables for unexpected administrator accounts and delete unauthorized entries
- Reset default_role to subscriber and set users_can_register to 0 if open registration is not required
- Rotate credentials and secret keys defined in wp-config.php after remediation
Patch Information
Review the Croma Changelog File for updates released after version 3.6. Apply the vendor-supplied fixed version once available and confirm the ironMusic_ajax handler enforces current_user_can('manage_options') and a valid nonce.
Workarounds
- Restrict access to /wp-admin/admin-ajax.php for the ironMusic_ajax action at the web application firewall layer
- Disable user registration by unchecking "Anyone can register" in WordPress General Settings
- Limit new account creation to trusted email domains through a registration gate plugin
# Enforce safe registration defaults using WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber
# Identify unexpected administrators
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
