CVE-2024-12259: RepairBuddy Privilege Escalation Flaw

CVE-2024-12259 Overview

CVE-2024-12259 is a privilege escalation vulnerability in the CRM WordPress Plugin – RepairBuddy for WordPress. The flaw affects all versions up to and including 3.8120. The plugin fails to validate a user's identity before updating their email address through the wc_update_user_data AJAX action. Authenticated attackers holding subscriber-level access or above can modify the email of any user, including administrators. After changing the target email, the attacker triggers a password reset to gain full account access. The weakness maps to CWE-862: Missing Authorization.

Critical Impact

A subscriber-level account can take over any WordPress administrator account, leading to full site compromise.

Affected Products

• CRM WordPress Plugin – RepairBuddy (computer-repair-shop)
• All versions up to and including 3.8120
• WordPress installations running the vulnerable plugin

Discovery Timeline

• 2024-12-18 - CVE-2024-12259 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12259

Vulnerability Analysis

The vulnerability resides in the wc_update_user_data AJAX handler exposed by the RepairBuddy plugin. The handler accepts a user identifier and a new email address from the request body. It updates the target user record without confirming that the requesting user owns that record or holds an administrative role. Any authenticated session at subscriber level or higher can call the endpoint. The plugin treats authenticated status as sufficient authorization, which violates least-privilege principles.

An attacker uses this behavior to overwrite the email of a privileged account with an attacker-controlled address. The attacker then requests a WordPress password reset for that account. WordPress delivers the reset link to the newly assigned email, allowing the attacker to set a new password and log in as an administrator.

Root Cause

The root cause is missing authorization ([CWE-862]) in the AJAX action. The handler lacks a current_user_can() capability check and does not validate that the submitted user ID matches the session user. Nonce verification alone, if present, does not restrict which user record can be modified.

Attack Vector

Exploitation requires network access to the WordPress site and a valid low-privileged account. Registration-open sites amplify the risk because attackers can self-provision subscriber accounts. The attacker sends a crafted POST request to admin-ajax.php with action=wc_update_user_data, the target administrator's user ID, and an attacker-controlled email address. A subsequent password reset request completes the takeover.

Refer to the Wordfence Vulnerability Report and the WordPress plugin changeset for the underlying code fix.

Detection Methods for CVE-2024-12259

Indicators of Compromise

• Unexpected POST requests to /wp-admin/admin-ajax.php containing action=wc_update_user_data from low-privileged sessions.
• Recent email address changes on administrator accounts in the wp_users table without corresponding admin activity.
• Password reset emails delivered to unfamiliar external addresses for privileged users.
• New administrator logins from unfamiliar IP addresses shortly after an email change.

Detection Strategies

• Audit the wp_users table for administrator email changes since December 2024 and compare against known-good values.
• Review web server access logs for admin-ajax.php requests referencing wc_update_user_data submitted by non-administrator users.
• Correlate email change events with subsequent wp_lostpassword and successful login events on the same account.

Monitoring Recommendations

• Enable WordPress audit logging plugins to capture profile and email modifications for all users.
• Alert on password reset requests targeting administrator accounts.
• Track privilege changes and new administrator role assignments in near real time.

How to Mitigate CVE-2024-12259

Immediate Actions Required

• Update the RepairBuddy plugin to the version released after 3.8120 that contains the authorization fix.
• Audit all administrator accounts and reset credentials for any account with a modified email address.
• Disable open user registration if it is not required for business operations.
• Enforce multi-factor authentication on all administrator and editor accounts.

Patch Information

The vendor addressed the flaw in a subsequent plugin release. The fix is documented across the WordPress plugin repository changesets, including changeset 3204501, changeset 3206568, and changeset 3208270. The patch adds capability checks that ensure the requesting user is authorized to modify the target user's data.

Workarounds

• Deactivate the RepairBuddy plugin until the site can be updated to a patched release.
• Restrict access to admin-ajax.php via a Web Application Firewall (WAF) rule that blocks the wc_update_user_data action for non-administrator users.
• Temporarily remove subscriber-level self-registration to reduce the attacker pool.

# Example WAF rule (ModSecurity) to block the vulnerable AJAX action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1002459,\
   msg:'Block RepairBuddy wc_update_user_data CVE-2024-12259'"
  SecRule ARGS:action "@streq wc_update_user_data" "t:none"