CVE-2024-12594 Overview
CVE-2024-12594 affects the Custom Login Page Styler WordPress plugin, which provides login customization, temporary admin access, and login attempt limiting features. The vulnerability allows authenticated attackers with Subscriber-level access or higher to authenticate as other users, including additional subscribers. The flaw resides in the lps_generate_temp_access_url AJAX action, which lacks a proper capability check. All versions up to and including 7.1.1 are affected. The weakness is classified as Missing Authorization [CWE-862].
Critical Impact
Authenticated attackers with minimal privileges can generate temporary access URLs to log in as arbitrary users, enabling account takeover across the WordPress site.
Affected Products
- Custom Login Page Styler plugin for WordPress (versions ≤ 7.1.1)
- WordPress sites using the plugin's temporary admin login feature
- Any deployment allowing Subscriber-level or higher registration
Discovery Timeline
- 2024-12-24 - CVE-2024-12594 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12594
Vulnerability Analysis
The Custom Login Page Styler plugin exposes an AJAX endpoint named lps_generate_temp_access_url that produces a URL granting login access to a specified user account. The endpoint verifies that the requester is authenticated but fails to enforce a capability check restricting the action to administrators. As a result, any authenticated user, including Subscribers, can invoke the endpoint and obtain a temporary access URL for another account.
The issue falls under Missing Authorization [CWE-862] and is exploitable over the network with low attack complexity. Successful exploitation compromises confidentiality, integrity, and availability of the target site because the attacker gains the target user's session context.
Root Cause
The root cause is the absence of a current_user_can() capability check inside the AJAX handler registered against wp_ajax_lps_generate_temp_access_url. WordPress registers the handler for authenticated users but delegates authorization enforcement to the plugin, which the plugin omits. Nonce validation, if present, is insufficient because a low-privileged authenticated user can obtain a valid nonce from accessible pages.
Attack Vector
An attacker registers or holds a Subscriber account on the target WordPress site. The attacker then issues an authenticated POST request to /wp-admin/admin-ajax.php with the action lps_generate_temp_access_url and a target user identifier. The server returns a temporary login URL that, when visited, authenticates the attacker as the specified user. This enables horizontal privilege escalation against other subscribers and, depending on plugin logic, may enable escalation to higher-privileged accounts.
See the Wordfence Vulnerability Analysis for additional technical details and the fix commit in the WordPress Plugin Change Log.
Detection Methods for CVE-2024-12594
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php containing the parameter action=lps_generate_temp_access_url originating from non-administrator sessions.
- Unexpected session initiations for user accounts from IP addresses previously associated with Subscriber activity.
- Newly issued temporary access URLs in plugin logs that were not authorized by an administrator.
Detection Strategies
- Inspect web server and WordPress access logs for the lps_generate_temp_access_url action invoked by users lacking the manage_options capability.
- Correlate AJAX invocations with subsequent successful wp_login events tied to different account identifiers within short time windows.
- Deploy a Web Application Firewall rule that blocks the vulnerable action unless the requester holds an administrator role.
Monitoring Recommendations
- Monitor authentication telemetry for anomalous cross-account login patterns and session reuse across IP addresses.
- Alert on privilege changes, temporary access URL generation events, and role modifications performed outside administrator sessions.
- Track plugin version inventory across managed WordPress hosts to identify sites still running versions at or below 7.1.1.
How to Mitigate CVE-2024-12594
Immediate Actions Required
- Update the Custom Login Page Styler plugin to a version above 7.1.1 as soon as the vendor-patched release is available.
- Audit all WordPress user accounts and remove untrusted Subscriber-level accounts created during the exposure window.
- Rotate passwords and invalidate active sessions for accounts that may have been impersonated.
Patch Information
The vendor addressed the vulnerability in the changeset published in the WordPress Plugin Change Log. The fix introduces a capability check in the lps_generate_temp_access_url AJAX handler, restricting execution to administrators. Site owners should upgrade to the latest release available in the WordPress plugin repository.
Workarounds
- Disable or uninstall the Custom Login Page Styler plugin until the patched version is deployed.
- Restrict new user registration or set the default role to a non-privileged value to reduce the attacker pool.
- Add a WAF rule to reject requests to admin-ajax.php with action=lps_generate_temp_access_url from non-administrator sessions.
# Example ModSecurity rule blocking unauthenticated invocation
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
"chain,deny,status:403,id:1002594,msg:'Block CVE-2024-12594 AJAX action'"
SecRule ARGS:action "@streq lps_generate_temp_access_url" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
