CVE-2024-12402: WordPress Themes Coder Plugin Vulnerability

CVE-2024-12402 Overview

The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress contains a critical privilege escalation vulnerability through account takeover. All versions up to and including 1.3.4 are affected by this security flaw, which stems from improper user identity validation in the update_user_profile() function. This authentication bypass (CWE-288) allows unauthenticated attackers to change any user's password without proper authorization, including administrator accounts.

Critical Impact

Unauthenticated attackers can reset arbitrary user passwords, including administrators, enabling complete site takeover without any prior authentication or user interaction.

Affected Products

• Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin versions ≤ 1.3.4
• WordPress installations using the vulnerable tc-ecommerce plugin
• WooCommerce sites with the mobile app integration plugin enabled

Discovery Timeline

• 2025-01-07 - CVE-2024-12402 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-12402

Vulnerability Analysis

This vulnerability is classified as Authentication Bypass Using an Alternate Path or Channel (CWE-288). The flaw exists in the update_user_profile() function within the app_user.php controller file. The plugin fails to implement proper user identity verification before allowing password changes, creating a direct path for unauthenticated attackers to compromise any user account on the WordPress installation.

The vulnerability is particularly severe because it requires no authentication, can be exploited remotely over the network, and requires no user interaction. An attacker can leverage this flaw to gain administrative access to WordPress sites, potentially leading to complete site compromise, data theft, malware injection, or further lateral movement within the hosting infrastructure.

Root Cause

The root cause lies in missing authentication checks within the update_user_profile() function located in /controller/app_user.php. The function processes password update requests without verifying that the requester has the authorization to modify the target user's credentials. This allows any remote attacker to specify an arbitrary user ID and set a new password without proving ownership of that account.

Attack Vector

The attack vector is network-based, requiring no privileges, no user interaction, and presenting low attack complexity. An attacker can craft a malicious request to the vulnerable endpoint, specifying a target user ID (such as an administrator) along with a new password. Since the plugin does not validate the requester's identity or authorization level, the password change is processed, granting the attacker access to the targeted account.

The vulnerability was identified in the plugin's code repository. Technical details can be found in the WordPress Plugin Code Review. The vulnerable function accepts user profile update requests and directly modifies user credentials without implementing proper authentication or authorization controls.

Detection Methods for CVE-2024-12402

Indicators of Compromise

• Unexpected password reset events for administrator or privileged user accounts in WordPress logs
• Unusual API requests to the tc-ecommerce plugin endpoints, particularly those targeting user profile updates
• New administrator accounts or modified user privileges without authorized changes
• Login activity from unfamiliar IP addresses following password modification events
• WordPress user table modifications with timestamps correlating to suspicious network activity

Detection Strategies

• Monitor WordPress authentication logs for password changes that were not initiated through the standard wp-admin interface
• Implement Web Application Firewall (WAF) rules to detect and block unauthorized requests to the plugin's user profile update endpoints
• Review access logs for unusual POST requests to /wp-content/plugins/tc-ecommerce/controller/app_user.php
• Deploy intrusion detection signatures that identify exploitation attempts targeting authentication bypass patterns

Monitoring Recommendations

• Enable detailed logging for all WordPress user account modifications and authentication events
• Configure alerts for any administrative account password changes outside of normal business hours or approved change windows
• Implement file integrity monitoring for WordPress core files and plugin directories to detect post-compromise modifications
• Monitor outbound connections from the web server for signs of data exfiltration or command-and-control communication

How to Mitigate CVE-2024-12402

Immediate Actions Required

• Update the Themes Coder plugin to a version newer than 1.3.4 that contains the security fix
• Conduct an immediate audit of all WordPress user accounts to identify any unauthorized password changes or new administrator accounts
• Reset passwords for all administrative accounts as a precautionary measure
• Review web server access logs for evidence of exploitation attempts against the vulnerable endpoint
• Consider temporarily deactivating the plugin if an immediate update is not possible

Patch Information

The vulnerability has been addressed in the plugin update. The security fix can be reviewed in the WordPress Change Set Update. Additional technical details are available in the Wordfence Vulnerability Report. Site administrators should update to the latest available version through the WordPress plugin repository.

Workarounds

• Deactivate and remove the Themes Coder plugin if it is not actively required for business operations
• Implement IP-based access restrictions to the plugin's API endpoints using .htaccess or web server configuration
• Deploy a Web Application Firewall with rules to block unauthenticated requests to sensitive plugin endpoints
• Enable two-factor authentication for all WordPress administrator accounts to provide an additional layer of protection even if passwords are compromised

# Temporary mitigation: Restrict access to the vulnerable controller file
# Add to your WordPress .htaccess file
<Files "app_user.php">
    Order Deny,Allow
    Deny from all
    # Allow only from trusted management IPs if needed
    # Allow from 192.168.1.0/24
</Files>