CVE-2024-13554: WP Extended Auth Bypass Vulnerability

CVE-2024-13554 Overview

CVE-2024-13554 affects the Ultimate WordPress Toolkit – WP Extended plugin for WordPress. The vulnerability stems from a missing capability check on the reorder_route() function in all versions up to and including 3.0.13. Unauthenticated attackers can invoke the function to reorder posts on affected sites.

The flaw is categorized under [CWE-862] Missing Authorization. It impacts integrity by allowing attackers to modify the display order of published content without authentication. Confidentiality and availability remain unaffected.

Critical Impact
Unauthenticated attackers can reorder WordPress posts on sites running vulnerable versions of the WP Extended plugin, enabling unauthorized content manipulation.

Affected Products

WP Extended (Ultimate WordPress Toolkit) plugin for WordPress
All versions up to and including 3.0.13
Vendor: wpextended

Discovery Timeline

2025-02-12 - CVE-2024-13554 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13554

Vulnerability Analysis

The WP Extended plugin exposes a reorder_route() function that handles post reordering requests. The function processes requests without verifying user capabilities or authentication state. This allows any network-based actor to submit reorder requests and alter the stored order of posts.

The vulnerability only affects integrity. Attackers cannot read sensitive data or disrupt site availability through this flaw. The impact is limited to manipulation of post ordering, which can disrupt editorial workflows or distort content presentation.

Root Cause

The root cause is a missing authorization check [CWE-862] inside the reorder_route() handler. The function does not call WordPress capability APIs such as current_user_can() or verify a valid nonce before applying changes. Any request reaching the endpoint is processed as authorized.

Attack Vector

Exploitation requires no authentication, no user interaction, and no elevated privileges. An attacker sends a crafted HTTP request to the plugin's reorder endpoint. The plugin accepts the request and updates post order values in the database. See the Wordfence Vulnerability Report for additional technical context.

// No verified exploit code available.
// The vulnerability is triggered by issuing an unauthenticated HTTP request
// to the plugin route backed by the reorder_route() function, which lacks
// a capability check and nonce verification.

Detection Methods for CVE-2024-13554

Indicators of Compromise

Unexpected changes in the menu_order field of WordPress posts without a corresponding administrative action in audit logs.
HTTP requests to WP Extended reorder endpoints originating from unauthenticated sessions or unknown IP addresses.
Editorial content appearing in a different sequence than configured by site administrators.

Detection Strategies

Review web server access logs for requests targeting WP Extended routes that invoke reorder_route().
Correlate post order changes in the database with authenticated administrator sessions to find unauthorized modifications.
Deploy a web application firewall rule that blocks unauthenticated requests to plugin administrative endpoints.

Monitoring Recommendations

Enable WordPress audit logging to track changes to post metadata and ordering.
Monitor the installed version of the WP Extended plugin across managed WordPress sites and flag versions at or below 3.0.13.
Alert on anomalous bursts of requests to plugin REST or AJAX endpoints that lack authentication cookies.

How to Mitigate CVE-2024-13554

Immediate Actions Required

Update the WP Extended plugin to a version later than 3.0.13 on all WordPress installations.
Audit recent post ordering changes to identify unauthorized modifications and restore the intended order where needed.
Restrict administrative plugin endpoints behind a web application firewall until patching is confirmed.

Patch Information

The vendor addressed the issue in a release following 3.0.13. Refer to the WordPress Plugin Change Log for the specific changeset that introduced the capability check. Site operators should upgrade through the WordPress plugin management interface.

Workarounds

Disable the WP Extended plugin until the patched version is installed if immediate updates are not possible.
Block external access to the plugin's reorder endpoint at the web server or WAF layer.
Limit plugin administrative routes to trusted internal IP ranges where feasible.

bash

# Example WordPress CLI command to update the plugin
wp plugin update wp-extended

# Verify the installed version is above 3.0.13
wp plugin get wp-extended --field=version