CVE-2024-13364 Overview
The Raptive Ads plugin for WordPress contains a missing authorization vulnerability in the site_ads_files_reset() and cls_file_reset() functions. All versions up to and including 3.6.3 lack a capability check on these functions. Unauthenticated attackers can send crafted network requests to reset the ad and cls files used by the plugin. The flaw is tracked under CWE-862: Missing Authorization and affects WordPress sites monetizing content through Raptive advertising integration.
Critical Impact
Unauthenticated remote attackers can reset ad configuration and cls files on any affected WordPress site, disrupting publisher ad delivery and revenue.
Affected Products
- Raptive Ads plugin for WordPress (formerly AdThrive Ads)
- All versions up to and including 3.6.3
- WordPress sites using the plugin for ad monetization
Discovery Timeline
- 2025-02-19 - CVE-2024-13364 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13364
Vulnerability Analysis
The Raptive Ads plugin exposes two reset functions, site_ads_files_reset() and cls_file_reset(), through WordPress action hooks accessible over the network. Both functions execute their reset logic without validating the caller's WordPress capabilities or verifying a nonce. This design gap allows any unauthenticated request that reaches the plugin's reset endpoints to trigger file resets. The impact is limited to integrity of the ad configuration files, with no direct confidentiality or availability effect on the underlying WordPress installation.
Root Cause
The root cause is a missing capability check [CWE-862] in the plugin's reset handlers. WordPress plugins are expected to gate privileged actions using current_user_can() checks and to validate wp_nonce tokens on state-changing requests. Neither guard is present on site_ads_files_reset() or cls_file_reset() in versions through 3.6.3. The fix applied in the plugin changeset introduces authorization enforcement before the reset routines execute. See the WordPress Plugin Changeset for the code-level correction.
Attack Vector
Exploitation requires only network access to a vulnerable WordPress site. An attacker sends an HTTP request that invokes the exposed reset actions. Because no authentication or capability check is enforced, the request succeeds and the plugin resets its ad and cls files. Publishers may observe broken ad units, lost customizations, or repeated revenue disruption if an attacker automates the reset. Refer to the Wordfence Vulnerability Report for additional context on the affected endpoints.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2024-13364
Indicators of Compromise
- Unexpected resets of Raptive Ads plugin configuration files, particularly cls and ad file artifacts stored by the plugin.
- Web server access logs showing unauthenticated POST or GET requests targeting Raptive Ads plugin action endpoints.
- Sudden loss of custom ad unit configuration or ad delivery failures reported by publishers.
Detection Strategies
- Monitor WordPress admin-ajax.php and plugin action requests for calls that reach site_ads_files_reset or cls_file_reset from unauthenticated sessions.
- Enable file integrity monitoring on the Raptive Ads plugin directory to alert on unexpected modifications to ad and cls files.
- Correlate web access logs with plugin activity to identify anomalous reset patterns from single source IPs.
Monitoring Recommendations
- Ingest WordPress and web server logs into a centralized log platform for query-based hunting on plugin action names.
- Alert on repeated requests to Raptive Ads endpoints originating from IPs without prior authenticated sessions.
- Track plugin version inventory across all managed WordPress sites to flag installations still running 3.6.3 or earlier.
How to Mitigate CVE-2024-13364
Immediate Actions Required
- Update the Raptive Ads plugin to a version later than 3.6.3 that includes the capability check fix.
- Audit WordPress sites in the estate to identify installations of the Raptive Ads (or legacy AdThrive Ads) plugin.
- Review web server logs for prior requests to the vulnerable reset endpoints and restore ad configuration if resets occurred.
Patch Information
The vendor addressed the missing authorization in the plugin changeset published at WordPress Plugin Changeset 3244125. Administrators should install the fixed release available from the AdThrive Ads Plugin Page through the WordPress plugin updater. Confirm the installed version reports higher than 3.6.3 after updating.
Workarounds
- Restrict access to the WordPress site with a Web Application Firewall (WAF) rule blocking requests that invoke the affected plugin actions from unauthenticated sources.
- Temporarily deactivate the Raptive Ads plugin on sites that cannot be updated immediately.
- Enforce IP allowlisting on WordPress admin and AJAX endpoints where feasible.
# Example WP-CLI commands to check and update the plugin
wp plugin list --name=adthrive-ads --fields=name,status,version
wp plugin update adthrive-ads
wp plugin get adthrive-ads --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
