CVE-2024-13375: Adifier WordPress Privilege Escalation

CVE-2024-13375 Overview

The Adifier System plugin for WordPress contains a critical privilege escalation vulnerability that allows unauthenticated attackers to take over any user account, including administrator accounts. This vulnerability exists in all versions up to and including 3.1.7 and stems from improper validation of user identity in the password recovery functionality.

Critical Impact

Unauthenticated attackers can change any user's password, including administrators, enabling complete site takeover without any prior authentication.

Affected Products

• Adifier System plugin for WordPress versions up to and including 3.1.7
• WordPress sites utilizing the Adifier classified ads theme functionality

Discovery Timeline

• 2025-01-18 - CVE CVE-2024-13375 published to NVD
• 2025-01-18 - Last updated in NVD database

Technical Details for CVE-2024-13375

Vulnerability Analysis

This vulnerability is classified as CWE-620 (Unverified Password Change), a weakness where an application allows password changes without properly verifying the identity of the requesting user. The adifier_recover() function in the Adifier System plugin fails to implement adequate identity verification before processing password change requests.

The vulnerability allows remote attackers to exploit the password recovery mechanism to reset passwords for arbitrary user accounts. Because the function does not properly validate that the password change request originates from the legitimate account owner, an attacker can target any registered user—including site administrators—and reset their credentials.

Root Cause

The root cause lies in the adifier_recover() function's inadequate identity verification logic. The function processes password reset requests without confirming that the requester is authorized to change the specified account's password. This missing authentication check allows any unauthenticated user to invoke the password change functionality for any account on the WordPress installation.

Attack Vector

The attack is network-based and requires no authentication, user interaction, or special privileges. An attacker can remotely target the vulnerable password recovery endpoint and submit crafted requests to change the password of any user account. The attack flow typically involves:

1. Identifying a target WordPress site running a vulnerable version of the Adifier System plugin
2. Crafting a malicious request to the adifier_recover() function
3. Specifying a target user account (such as an administrator)
4. Setting a new password controlled by the attacker
5. Logging in with the compromised credentials to gain full access

The complete lack of authentication requirements and the ability to target administrator accounts makes this vulnerability particularly severe, as it can result in complete WordPress site compromise.

Detection Methods for CVE-2024-13375

Indicators of Compromise

• Unexpected password reset activity for administrator or user accounts without corresponding legitimate requests
• Suspicious POST requests to Adifier plugin endpoints, particularly those related to password recovery functionality
• Multiple failed login attempts followed by successful administrator logins from unfamiliar IP addresses
• Unauthorized changes to site configuration, user roles, or content following password reset events

Detection Strategies

• Monitor WordPress audit logs for password reset events that lack corresponding email confirmation clicks from legitimate users
• Implement web application firewall (WAF) rules to detect and block suspicious requests targeting the Adifier plugin's recovery endpoints
• Review access logs for unusual patterns of requests to plugin AJAX handlers or REST endpoints
• Deploy file integrity monitoring to detect unauthorized modifications following potential account compromise

Monitoring Recommendations

• Enable comprehensive WordPress activity logging with plugins such as WP Activity Log or similar solutions
• Configure alerts for administrator password changes and new administrator account creation
• Monitor for unusual login patterns, including logins from new geographic locations or IP addresses
• Regularly audit user accounts and roles for unauthorized modifications

How to Mitigate CVE-2024-13375

Immediate Actions Required

• Update the Adifier System plugin to a patched version as soon as one becomes available from the vendor
• Review all administrator and user accounts for signs of unauthorized access or password changes
• Force password resets for all administrator accounts if compromise is suspected
• Consider temporarily disabling the Adifier plugin until a patch is available if the site cannot be otherwise protected

Patch Information

Site administrators should monitor the ThemeForest Adifier product page for updates. Additional vulnerability details are available in the Wordfence Vulnerability Report. Apply vendor-provided patches immediately upon release.

Workarounds

• Implement a web application firewall (WAF) rule to block unauthenticated requests to the Adifier password recovery functionality
• Restrict access to WordPress administrative endpoints using IP allowlisting where feasible
• Enable multi-factor authentication (MFA) for all administrator accounts to add an additional layer of protection
• Consider disabling the password recovery feature at the plugin or theme level until a patch is available

# Example: Restrict access to wp-admin by IP in .htaccess
<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    Allow from YOUR_TRUSTED_IP
</Files>