CVE-2024-13318: Essential WP Real Estate Auth Bypass Flaw

CVE-2024-13318 Overview

CVE-2024-13318 affects the Essential WP Real Estate plugin for WordPress. The plugin fails to enforce a capability check on the cl_delete_listing_func() AJAX handler. Unauthenticated attackers can invoke this function to delete arbitrary pages and posts on affected sites. All versions up to and including 1.1.3 are vulnerable.

The root weakness is classified under [CWE-463] (Deletion of Data Structure Sentinel) and falls into the broader category of Missing Authorization. Successful exploitation degrades site integrity by removing published content but does not disclose data or crash the server.

Critical Impact

Any remote unauthenticated user can permanently delete arbitrary WordPress pages and posts on sites running vulnerable versions of the plugin.

Affected Products

• Smartdatasoft Essential WP Real Estate plugin for WordPress, versions <= 1.1.3
• WordPress sites using the vulnerable plugin with the AJAX endpoint reachable
• Any hosting environment exposing wp-admin/admin-ajax.php publicly (default WordPress behavior)

Discovery Timeline

• 2025-01-10 - CVE-2024-13318 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13318

Vulnerability Analysis

The Essential WP Real Estate plugin registers an AJAX action that maps to the cl_delete_listing_func() function inside src/Common/Ajax/Ajax.php. WordPress plugins typically gate destructive actions behind two controls: a current_user_can() capability check and a nonce verification through check_ajax_referer(). This handler omits the capability check, and the action is registered under wp_ajax_nopriv_, allowing unauthenticated requests to reach it.

Because the handler accepts a post identifier from the request and passes it directly to wp_delete_post() (or an equivalent deletion primitive), any attacker who can reach admin-ajax.php can specify arbitrary post IDs. The deletion is not restricted to real-estate listing custom post types, so pages, blog posts, and other content types can be removed. Impact is limited to integrity of stored content; confidentiality and availability of the server itself are not directly affected.

Root Cause

The root cause is a missing authorization check on a state-changing AJAX endpoint. The cl_delete_listing_func() function does not verify that the requester holds the delete_posts or delete_post capability for the target object, and the endpoint is exposed to unauthenticated users through the wp_ajax_nopriv_ hook.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends a POST request to /wp-admin/admin-ajax.php specifying the vulnerable action and a target post ID. No credentials, user interaction, or elevated privileges are required. Refer to the WordPress Plugin Source Code and the Wordfence Vulnerability Report for the handler location and analysis.

No public proof-of-concept exploit code has been verified for this advisory. The vulnerability mechanism is described in prose only.

Detection Methods for CVE-2024-13318

Indicators of Compromise

• Unexpected disappearance of pages, posts, or listings from the WordPress admin dashboard
• POST requests to /wp-admin/admin-ajax.php with an action parameter referencing the Essential WP Real Estate delete handler from unauthenticated sessions
• Entries in wp_posts transitioning to trash status or being removed without corresponding admin user activity in audit logs

Detection Strategies

• Inspect web server access logs for POST requests to admin-ajax.php originating from anonymous sources with action=cl_delete_listing or similar identifiers
• Correlate WordPress activity logs (via plugins such as WP Activity Log) with server access logs to identify deletions with no authenticated session
• Deploy WordPress-aware WAF rules that alert on unauthenticated invocations of plugin-specific AJAX actions

Monitoring Recommendations

• Enable content-change auditing on WordPress databases and forward events to a centralized log platform
• Monitor the count of published posts and pages daily and alert on unexplained decreases
• Track HTTP 200 responses to admin-ajax.php requests with no authentication cookie, grouped by action name

How to Mitigate CVE-2024-13318

Immediate Actions Required

• Update the Essential WP Real Estate plugin to a version later than 1.1.3 as soon as the vendor publishes a fix
• If no patched version is available, deactivate and remove the plugin from all affected WordPress installations
• Restore any deleted posts or pages from database backups and validate content integrity

Patch Information

At the time of publication, the Wordfence Vulnerability Report tracks fixed-version status. Administrators should consult the WordPress plugin repository and vendor advisories for the current patched release and apply it through the WordPress admin plugin updater or WP-CLI.

Workarounds

• Block unauthenticated POST requests to the vulnerable AJAX action at the WAF or reverse proxy layer
• Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible, while preserving legitimate front-end AJAX functionality
• Enforce database and file backups on a short interval so that arbitrary deletions can be reversed quickly

# Example nginx rule to block the vulnerable AJAX action for unauthenticated users
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "cl_delete_listing") {
        return 403;
    }
}