CVE-2024-13373: Exertio Framework Privilege Escalation

CVE-2024-13373 Overview

CVE-2024-13373 is a privilege escalation vulnerability in the Exertio Framework plugin for WordPress, affecting all versions up to and including 1.3.1. The flaw resides in the fl_forgot_pass_new() function, which fails to validate a user's identity before updating their password. Unauthenticated attackers can change the password of any user, including administrators, and take over the account. The weakness is categorized under CWE-620: Unverified Password Change.

Critical Impact
Unauthenticated remote attackers can reset any WordPress user's password — including administrators — leading to full site compromise.

Affected Products

Exertio Framework plugin for WordPress (all versions ≤ 1.3.1)
Sites bundling the Exertio Freelance Marketplace WordPress Theme
WordPress installations using the vulnerable fl_forgot_pass_new() password reset workflow

Discovery Timeline

2025-03-01 - CVE-2024-13373 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-13373

Vulnerability Analysis

The vulnerability is a business logic flaw in the password reset workflow exposed by the Exertio Framework plugin. The plugin registers the fl_forgot_pass_new() handler to process new password submissions but omits identity verification before writing the password to the database. An attacker submits a request supplying a target username or user identifier together with a chosen password. The plugin updates the targeted account's credentials without confirming a valid reset token, current password, or authenticated session.

Because WordPress administrator accounts share the same reset endpoint, an attacker can pivot from unauthenticated access to full administrative control. From there, an attacker can install malicious plugins, execute PHP code, exfiltrate data, or pivot deeper into the hosting environment.

Root Cause

The root cause is missing authorization in the password change routine. The fl_forgot_pass_new() function does not verify a one-time reset token, nonce, or current password against the requested user before persisting the new credentials. This maps directly to CWE-620, where a product allows a password change without verifying the requester's identity.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP POST request to the plugin's password reset endpoint with the target account identifier and an attacker-chosen password. After the request completes, the attacker logs in with the new credentials. The high attack complexity reflects the need to identify a valid target account identifier, but administrator usernames are often enumerable on WordPress sites.

No verified exploit code is published. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-13373

Indicators of Compromise

Unexpected user_pass updates in the wp_users table for administrator accounts.
New administrator-level users created shortly after access to a password reset endpoint.
POST requests to plugin endpoints invoking fl_forgot_pass_new from unfamiliar IP addresses.
Successful logins from new geolocations followed by plugin or theme uploads.

Detection Strategies

Inspect web server access logs for POST requests targeting Exertio plugin AJAX or admin-ajax routes referencing fl_forgot_pass_new.
Correlate password change events in WordPress with the absence of a preceding password reset email request.
Enable WordPress audit logging plugins to record user role changes and credential updates.

Monitoring Recommendations

Alert on any modification of accounts with the administrator role outside scheduled maintenance windows.
Monitor for newly uploaded plugin or theme files following authentication events from previously unseen IP addresses.
Track repeated requests to the plugin's password reset endpoint as a potential enumeration or exploitation attempt.

How to Mitigate CVE-2024-13373

Immediate Actions Required

Disable or remove the Exertio Framework plugin until a vendor patch is verified and applied.
Force a password reset for all administrator and editor accounts on affected WordPress sites.
Rotate WordPress secret keys in wp-config.php to invalidate existing sessions.
Review installed plugins, themes, and users for unauthorized changes introduced during the exposure window.

Patch Information

No fixed version is identified in the available advisory data. Site administrators should consult the Wordfence Vulnerability Report and the ThemeForest product page for vendor updates and confirm the running version is greater than 1.3.1 once a patched release is published.

Workarounds

Block external access to the plugin's password reset endpoint at the web application firewall (WAF) layer.
Restrict /wp-admin/admin-ajax.php actions associated with the Exertio Framework using server-level access rules.
Enforce multi-factor authentication on all privileged WordPress accounts to limit takeover impact.
Temporarily deactivate the plugin if the Exertio functionality is not business-critical.

bash

# Example nginx rule to block requests targeting the vulnerable handler
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "fl_forgot_pass_new") { return 403; }
    if ($request_body ~* "action=fl_forgot_pass_new") { return 403; }
}