CVE-2024-12620: AnimateGL Plugin Auth Bypass Vulnerability

CVE-2024-12620 Overview

CVE-2024-12620 affects the AnimateGL Animations for WordPress plugin, which provides Elementor and Gutenberg block animations. The plugin exposes an agl_json AJAX action without a capability check, allowing unauthenticated attackers to modify plugin settings. All versions up to and including 1.4.23 are vulnerable. The flaw is categorized as Missing Authorization [CWE-862] and stems from the absence of privilege validation on a settings-update endpoint. Successful exploitation lets remote attackers alter plugin configuration without any authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can modify AnimateGL plugin settings on affected WordPress sites, undermining site configuration integrity.

Affected Products

AnimateGL Animations for WordPress plugin versions ≤ 1.4.23
WordPress sites using Elementor with the AnimateGL plugin installed
WordPress sites using Gutenberg blocks with the AnimateGL plugin installed

Discovery Timeline

2025-02-01 - CVE-2024-12620 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-12620

Vulnerability Analysis

The vulnerability resides in the plugin's agl_json AJAX action handler. The handler processes requests to update plugin settings but omits a capability check verifying that the requester holds administrative privileges. WordPress AJAX endpoints registered under wp_ajax_nopriv_ are reachable by unauthenticated visitors, and any registered action lacking a current_user_can() verification becomes an open configuration interface.

An attacker can issue a crafted POST request to /wp-admin/admin-ajax.php specifying the agl_json action along with attacker-controlled parameters. The plugin persists the submitted values into its options, changing how animations render across the site. Because integrity is the only affected security property in this issue, the attacker cannot directly read sensitive data or crash the site, but can tamper with plugin behavior.

Root Cause

The root cause is a missing authorization check [CWE-862] on a state-changing AJAX endpoint. The agl_json handler neither validates the caller's WordPress capabilities nor requires a valid nonce tied to an authenticated session. This design allows any network-based caller to reach and act on the settings-update path.

Attack Vector

Exploitation requires only network access to the vulnerable WordPress site. The attacker submits an HTTP POST to the plugin's AJAX endpoint with modified settings values. No credentials, user interaction, or elevated context are required. See the Wordfence Vulnerability Report for further technical detail.

No verified public proof-of-concept code is available for this issue. The exploitation pattern follows standard WordPress AJAX abuse against endpoints missing capability checks.

Detection Methods for CVE-2024-12620

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php containing action=agl_json from unauthenticated sources.
Unauthorized modifications to AnimateGL plugin options stored in the wp_options table.
Rendering changes or unexpected animation behavior across site pages without an administrative change record.

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php referencing the agl_json action, especially from unauthenticated IP addresses.
Alert on POST requests to admin-ajax.php lacking a valid wordpress_logged_in_* cookie when targeting plugin AJAX actions.
Compare plugin option values against a known-good baseline to detect unauthorized configuration changes.

Monitoring Recommendations

Enable WordPress audit logging to capture option changes and administrative actions with source IP attribution.
Forward web server and WordPress logs into a centralized analytics platform for correlation across sites.
Monitor plugin file integrity and installed version state to identify vulnerable deployments.

How to Mitigate CVE-2024-12620

Immediate Actions Required

Update the AnimateGL Animations plugin to a version later than 1.4.23 once a patched release is available from the vendor.
Audit the AnimateGL plugin settings stored in wp_options and restore any tampered values to known-good configuration.
Restrict access to /wp-admin/admin-ajax.php from unexpected geographies or IP ranges where feasible.

Patch Information

Refer to the WordPress plugin page for AnimateGL for the latest release information. Administrators should upgrade beyond version 1.4.23 and confirm the agl_json action is protected by an appropriate capability check and nonce validation.

Workarounds

Deactivate and remove the AnimateGL plugin until a fixed version is installed.
Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated POST requests where action=agl_json is present.
Enforce authentication or IP allow-listing on /wp-admin/admin-ajax.php for administrative AJAX actions.

bash

# Example WAF rule (ModSecurity syntax) to block unauthenticated agl_json requests
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1012620,msg:'Block unauth agl_json AJAX (CVE-2024-12620)'"
  SecRule ARGS:action "@streq agl_json" \
    "chain"
  SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"