CVE-2024-13770: Themerex Puzzles RCE Vulnerability

CVE-2024-13770 Overview

CVE-2024-13770 is a critical PHP Object Injection vulnerability affecting the Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress. The vulnerability exists in all versions up to and including 4.2.4 and stems from insecure deserialization of untrusted input in the view_more_posts AJAX action. This flaw allows unauthenticated attackers to inject malicious PHP objects into the application.

Critical Impact

Unauthenticated attackers can exploit this PHP Object Injection vulnerability to potentially execute arbitrary code, delete files, or retrieve sensitive data if a suitable POP (Property Oriented Programming) chain exists on the target system. The theme has been removed from the repository with no patch available.

Affected Products

• Puzzles | WP Magazine / Review with Store WordPress Theme versions up to and including 4.2.4
• Themerex Puzzles WordPress Theme (all versions)
• WordPress installations using the Puzzles theme with RTL support

Discovery Timeline

• 2025-02-13 - CVE-2024-13770 published to NVD
• 2025-02-24 - Last updated in NVD database

Technical Details for CVE-2024-13770

Vulnerability Analysis

This vulnerability represents a classic insecure deserialization flaw (CWE-502) within a WordPress theme context. The view_more_posts AJAX action accepts user-controlled input and passes it through PHP's deserialization functions without adequate validation or sanitization. When PHP deserializes untrusted data, an attacker can manipulate object properties and potentially trigger dangerous magic methods such as __wakeup(), __destruct(), or __toString().

The exploitation potential depends on the presence of a POP chain—a sequence of PHP classes with exploitable magic methods that can be chained together to achieve malicious outcomes. While the vulnerable theme itself does not contain a known POP chain, WordPress sites frequently include additional plugins and themes that may provide the necessary gadget classes to complete an attack chain.

Root Cause

The root cause of this vulnerability is the improper handling of user-supplied data in the AJAX endpoint. The view_more_posts action processes incoming data through PHP's unserialize() function without implementing proper input validation, type checking, or allowlist filtering. This violates secure coding practices that mandate treating all external input as untrusted and potentially malicious.

Attack Vector

The attack is network-based and requires no authentication or user interaction, making it highly exploitable. An attacker can craft a malicious HTTP request to the WordPress AJAX handler (wp-admin/admin-ajax.php) with the action parameter set to view_more_posts and include a serialized PHP object payload. The server-side code deserializes this payload, instantiating attacker-controlled objects.

If a compatible POP chain is present from other installed plugins or themes, the attacker can leverage this to:

• Execute arbitrary PHP code on the server
• Delete arbitrary files, potentially including critical WordPress configuration
• Read sensitive data such as database credentials from wp-config.php
• Establish persistent backdoor access to the compromised site

The attack targets the WordPress AJAX interface, which is publicly accessible at /wp-admin/admin-ajax.php, allowing exploitation from any network location without prior access to the WordPress installation.

Detection Methods for CVE-2024-13770

Indicators of Compromise

• Suspicious POST requests to /wp-admin/admin-ajax.php with action=view_more_posts containing serialized PHP object strings (look for patterns like O: followed by class names)
• Unexpected file modifications or deletions in the WordPress installation directory
• Web server access logs showing malformed or abnormally long payloads in AJAX requests
• Presence of new unknown PHP files in theme or upload directories indicating webshell deployment

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in request parameters
• Monitor WordPress AJAX endpoints for anomalous request patterns, particularly those targeting the view_more_posts action
• Deploy file integrity monitoring on critical WordPress files to detect unauthorized modifications
• Review web server logs for requests containing serialized object notation (O: prefix followed by integers and class names)

Monitoring Recommendations

• Enable detailed logging for all WordPress AJAX requests and regularly audit for suspicious patterns
• Configure intrusion detection systems to alert on PHP object injection attack signatures
• Monitor for new file creation events in the WordPress installation, especially PHP files outside normal update patterns
• Implement real-time alerting for any access attempts to the vulnerable AJAX action from external IP addresses

How to Mitigate CVE-2024-13770

Immediate Actions Required

• Remove the Puzzles theme immediately from all WordPress installations as no security patch is available
• Migrate to an actively maintained alternative WordPress magazine/review theme
• Audit the WordPress installation for signs of compromise including unauthorized files, modified core files, and suspicious database entries
• Review all installed plugins and themes for potential POP chain gadgets that could be leveraged in conjunction with this vulnerability

Patch Information

The developer has opted to remove the Puzzles theme from the ThemeForest repository, and no security patch has been released. The official recommendation is to discontinue use of this theme and migrate to alternative software. Users should refer to the Wordfence Vulnerability Report for the latest information and the ThemeForest Product Page for any vendor updates.

Workarounds

• Block AJAX requests containing the view_more_posts action at the web server or WAF level until the theme can be replaced
• Implement a custom WordPress filter or plugin to intercept and neutralize requests to the vulnerable endpoint
• Restrict access to wp-admin/admin-ajax.php from untrusted networks if feasible for your deployment
• Consider placing the site in maintenance mode during migration to prevent exploitation

# Apache .htaccess rule to block the vulnerable AJAX action
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$ [NC]
RewriteCond %{QUERY_STRING} action=view_more_posts [NC,OR]
RewriteCond %{REQUEST_BODY} action=view_more_posts [NC]
RewriteRule .* - [F,L]
</IfModule>