CVE-2024-13412: CozyStay WordPress Auth Bypass Flaw

CVE-2024-13412 Overview

CVE-2024-13412 affects the CozyStay hotel booking theme for WordPress. The theme exposes an ajax_handler function without a capability check, allowing unauthenticated attackers to invoke privileged actions over the network. All versions up to and including 1.7.0 are vulnerable. The weakness is classified as Missing Authorization [CWE-862] and impacts data integrity by enabling arbitrary modification of theme-managed data. No authentication or user interaction is required to exploit the flaw.

Critical Impact
Unauthenticated attackers can execute arbitrary actions exposed by the ajax_handler function, leading to unauthorized modification of WordPress site data.

Affected Products

CozyStay theme for WordPress, versions up to and including 1.7.0
WordPress sites running the CozyStay hotel booking theme
Any deployment exposing the unprotected ajax_handler AJAX endpoint

Discovery Timeline

2025-03-19 - CVE-2024-13412 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13412

Vulnerability Analysis

The CozyStay theme registers an AJAX endpoint that dispatches multiple action handlers through a single ajax_handler function. The function processes requests without verifying the caller's capabilities or validating a nonce. As a result, any client can submit requests to the wp-admin/admin-ajax.php endpoint and trigger sensitive actions.

The impact is limited to integrity. Attackers can modify data managed by the theme, including booking entries, configuration values, and other persisted state exposed through the handler. Confidentiality and availability are not directly affected according to the published CVSS vector.

Root Cause

The root cause is a Missing Authorization weakness [CWE-862]. The ajax_handler function does not call current_user_can() or an equivalent capability check before executing privileged operations. It also omits nonce verification through check_ajax_referer(), removing the secondary control that normally protects WordPress AJAX endpoints.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted HTTP POST request to the WordPress AJAX endpoint, specifying the vulnerable action and parameters. Because the handler does not authenticate the requester, the server processes the action as if it were authorized. This pattern is trivially scriptable and exposes any internet-reachable WordPress instance running CozyStay 1.7.0 or earlier.

No verified proof-of-concept code is published for this issue. See the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2024-13412

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php referencing CozyStay theme actions from unauthenticated sessions.
Unauthorized changes to booking records, theme options, or other CozyStay-managed data without a corresponding administrator login.
Spikes in AJAX traffic from a small set of source IPs targeting the CozyStay action parameter.

Detection Strategies

Review web server access logs for repeated admin-ajax.php requests with the CozyStay action parameter originating from unauthenticated clients.
Audit WordPress database tables managed by the theme for unexpected modifications, comparing against known-good backups.
Deploy a WordPress security plugin or web application firewall rule that flags AJAX calls to CozyStay endpoints lacking a valid nonce.

Monitoring Recommendations

Alert on high-volume requests to admin-ajax.php with anonymous session cookies.
Track integrity changes on theme option rows in wp_options and CozyStay custom tables.
Forward WordPress and web server logs to a central log platform and correlate AJAX activity with administrative changes.

How to Mitigate CVE-2024-13412

Immediate Actions Required

Update the CozyStay theme to a version later than 1.7.0 that includes the capability check fix, as referenced in the ThemeForest WordPress Theme Changelog.
Restrict access to wp-admin/admin-ajax.php for unauthenticated users at the web application firewall where feasible.
Audit recent changes to booking data and theme configuration to identify unauthorized modifications.

Patch Information

The vendor addressed the issue in a release published after version 1.7.0. Site administrators should consult the ThemeForest WordPress Theme Changelog for the specific fixed version and apply the update through the WordPress theme installer or the ThemeForest distribution.

Workarounds

Disable or remove the CozyStay theme until the patched version can be installed.
Deploy a web application firewall rule that blocks unauthenticated POST requests targeting the vulnerable CozyStay AJAX action.
Limit access to the WordPress admin and AJAX endpoints by source IP where the site serves a known administrator population.

bash

# Example WAF rule (ModSecurity) blocking unauthenticated CozyStay AJAX calls
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1004132024,\
  msg:'Block unauthenticated CozyStay ajax_handler (CVE-2024-13412)'"
  SecRule ARGS:action "@rx (?i)cozystay" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"