CVE-2024-13645: tagDiv Composer WordPress RCE Vulnerability

CVE-2024-13645 Overview

The tagDiv Composer plugin for WordPress contains a critical PHP Object Instantiation vulnerability that affects all versions up to and including 5.3. The vulnerability exists in the module parameter handling, allowing unauthenticated attackers to instantiate arbitrary PHP objects. While no known POP (Property Oriented Programming) chain exists within the vulnerable plugin itself, the presence of a compatible POP chain in another installed plugin or theme could enable severe exploitation scenarios including arbitrary file deletion, sensitive data retrieval, or remote code execution.

Critical Impact

Unauthenticated attackers can instantiate arbitrary PHP objects via the module parameter. If a POP chain exists in any installed plugin or theme, this could lead to remote code execution, arbitrary file deletion, or sensitive data exposure.

Affected Products

• tagDiv Composer plugin for WordPress versions up to and including 5.3
• WordPress sites using tagDiv themes with the Composer plugin
• Any WordPress installation with tagDiv Composer combined with plugins/themes containing POP chains

Discovery Timeline

• 2025-04-04 - CVE-2024-13645 published to NVD
• 2025-04-07 - Last updated in NVD database

Technical Details for CVE-2024-13645

Vulnerability Analysis

This PHP Object Instantiation vulnerability (CWE-94: Improper Control of Generation of Code) allows unauthenticated remote attackers to manipulate the module parameter to instantiate arbitrary PHP objects within the WordPress environment. The vulnerability is classified as an Object Injection flaw, which is a subset of code injection vulnerabilities.

The attack does not require any user interaction and can be executed remotely over the network with low complexity. Successful exploitation requires the presence of a POP chain in the target environment, which acts as a "gadget" that can be leveraged to perform malicious operations. POP chains are sequences of method calls that occur during object deserialization or instantiation, potentially leading to dangerous operations.

Root Cause

The root cause of this vulnerability lies in insufficient validation of user-controlled input in the module parameter. The tagDiv Composer plugin fails to properly sanitize or whitelist the classes that can be instantiated, allowing attackers to specify arbitrary class names. When these class names are processed, PHP instantiates the corresponding objects, triggering constructor and destructor methods that may have unintended side effects when exploited through POP chains.

Attack Vector

The attack is network-based and requires no authentication or privileges. An attacker can craft malicious HTTP requests targeting the vulnerable module parameter endpoint. The exploitation flow typically involves:

1. Identifying the tagDiv Composer plugin on a WordPress installation
2. Crafting a request with a malicious module parameter value specifying a class name
3. The plugin instantiates the attacker-specified object
4. If a POP chain exists in other installed components, magic methods (__construct, __destruct, __wakeup, etc.) execute the chain
5. Depending on the POP chain present, this could result in file operations, database access, or code execution

The vulnerability mechanism involves improper handling of the module parameter in the tagDiv Composer plugin. When a request contains a crafted module value, the plugin instantiates PHP objects without adequate validation. For detailed technical analysis, see the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-13645

Indicators of Compromise

• Unusual HTTP requests containing suspicious class names in the module parameter
• Unexpected PHP object instantiation errors in WordPress debug logs
• Anomalous file system activities such as unauthorized file deletions or modifications
• Database queries originating from object destructor methods

Detection Strategies

• Monitor web server access logs for requests targeting tagDiv Composer endpoints with unusual module parameter values
• Deploy Web Application Firewall (WAF) rules to detect and block PHP object injection patterns
• Implement file integrity monitoring to detect unauthorized changes to critical WordPress files
• Use WordPress security plugins with vulnerability scanning capabilities to identify outdated tagDiv Composer installations

Monitoring Recommendations

• Enable verbose WordPress error logging temporarily to capture object instantiation anomalies
• Monitor for new file creations in plugin directories and WordPress root
• Set up alerts for outbound connections from the web server that could indicate data exfiltration
• Review PHP error logs for serialization/unserialization warnings

How to Mitigate CVE-2024-13645

Immediate Actions Required

• Update tagDiv Composer plugin to the latest patched version immediately
• Audit installed plugins and themes for known POP chains that could be exploited in conjunction
• Review recent access logs for signs of exploitation attempts
• Consider temporarily disabling the tagDiv Composer plugin if an update is not immediately available

Patch Information

Security updates addressing this vulnerability should be obtained directly from tagDiv. Administrators should check the tagDiv Composer documentation for the latest version information and upgrade instructions. The Wordfence Vulnerability Report provides additional details on remediation status.

Workarounds

• Implement WAF rules to filter and block requests containing suspicious module parameter values
• Restrict access to WordPress admin and plugin endpoints via IP whitelisting where possible
• Remove unused plugins and themes that may contain exploitable POP chains
• Consider implementing additional input validation at the server level using ModSecurity or similar tools

# Example: ModSecurity rule to help detect object injection attempts
# Add to your ModSecurity configuration
SecRule ARGS:module "@rx ^[a-zA-Z_\\\x80-\\\xff][a-zA-Z0-9_\\\x80-\\\xff]*$" \
    "id:100001,\
    phase:2,\
    pass,\
    nolog"

SecRule ARGS:module "!@rx ^[a-zA-Z_\\\x80-\\\xff][a-zA-Z0-9_\\\x80-\\\xff]*$" \
    "id:100002,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'Potential PHP Object Injection attempt in tagDiv Composer module parameter'"