CVE-2024-13655: Flex Mag WordPress Theme DOS Vulnerability

CVE-2024-13655 Overview

CVE-2024-13655 affects the Flex Mag Responsive WordPress News Theme through version 3.5.2. The vulnerability stems from a missing capability check on the propanel_of_ajax_callback() function. Authenticated users with Subscriber-level access or above can delete arbitrary WordPress option values on affected sites. Deleting critical options triggers site errors and denies service to legitimate users. The flaw is categorized under [CWE-862] Missing Authorization.

Critical Impact

Any authenticated user with Subscriber privileges can delete arbitrary WordPress options, corrupting site configuration and causing a denial of service to legitimate visitors.

Affected Products

• Flex Mag - Responsive WordPress News Theme (all versions through 3.5.2)
• WordPress installations using the affected theme
• Sites permitting Subscriber-level registration

Discovery Timeline

• 2025-03-07 - CVE-2024-13655 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13655

Vulnerability Analysis

The Flex Mag theme registers an AJAX handler named propanel_of_ajax_callback() without verifying the caller's capabilities. WordPress exposes AJAX endpoints through admin-ajax.php, which any authenticated user can reach, including low-privilege Subscribers. The handler processes requests that delete option values from the wp_options table but never confirms that the caller holds manage_options or an equivalent capability. Attackers exploit this gap by supplying option names in AJAX requests, causing the site to remove configuration data required for normal operation.

Root Cause

The root cause is a missing authorization check inside propanel_of_ajax_callback(). WordPress developers must gate administrative AJAX handlers with current_user_can() calls and nonce validation through check_ajax_referer(). The Flex Mag theme omits both controls on this endpoint. As a result, request authentication alone determines access, ignoring the principle of least privilege.

Attack Vector

An attacker registers or logs in as a Subscriber, then sends a crafted POST request to /wp-admin/admin-ajax.php invoking the vulnerable action. The request payload names a WordPress option, and the handler deletes it from the database. Targeting options such as siteurl, home, template, or stylesheet breaks the site immediately. Because the exploit requires only network access and low privileges, automated scanners can weaponize it at scale.

No verified proof-of-concept code is publicly available. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-13655

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php referencing the propanel_of action from Subscriber-level accounts
• Unexpected deletions or missing rows in the wp_options table, particularly for keys like siteurl, home, or template
• WordPress error messages such as "Error establishing a database connection" or blank pages following AJAX activity
• New Subscriber account registrations followed shortly by AJAX traffic to theme-specific endpoints

Detection Strategies

• Enable WordPress debug logging and inspect admin-ajax.php requests for the propanel_of_ajax_callback action
• Correlate low-privilege user sessions with AJAX POST requests that reference option-deletion parameters
• Deploy a web application firewall rule that blocks requests to the vulnerable action from non-administrators
• Baseline the wp_options table and alert on unexpected delete_option() operations

Monitoring Recommendations

• Forward WordPress access logs and PHP error logs into a centralized analytics platform for continuous review
• Alert on repeated 200-response AJAX calls from Subscriber sessions within short time windows
• Track theme and plugin file changes to detect follow-on tampering after initial exploitation
• Monitor site availability with external synthetic checks to catch DoS conditions quickly

How to Mitigate CVE-2024-13655

Immediate Actions Required

• Update the Flex Mag theme to a version later than 3.5.2 as soon as the vendor publishes a fix
• Disable open user registration or restrict the Subscriber role until patching completes
• Audit wp_options values against a known-good backup and restore any missing entries
• Block the vulnerable AJAX action at the web application firewall for non-administrative users

Patch Information

The vendor distributes Flex Mag through ThemeForest. Review the ThemeForest product page for the latest release and changelog. Apply the fixed version once available and verify that the propanel_of_ajax_callback() function enforces current_user_can('manage_options') and a valid nonce.

Workarounds

• Remove or comment out the wp_ajax_propanel_of action registration in the theme's functions.php until an official patch ships
• Restrict /wp-admin/admin-ajax.php access to authenticated administrators through server-side rules where feasible
• Use a security plugin to add capability checks and nonce validation around theme AJAX endpoints
• Take regular database backups so administrators can restore deleted options quickly if exploitation occurs

# Example WAF rule blocking the vulnerable action for non-admin sessions
# Nginx snippet
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "propanel_of") {
        return 403;
    }
}