CVE-2024-13770: Themerex Puzzles RCE Vulnerability

CVE-2024-13770 Overview

CVE-2024-13770 is a critical PHP Object Injection vulnerability affecting the Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress. The vulnerability exists in all versions up to and including 4.2.4 and stems from insecure deserialization of untrusted input in the view_more_posts AJAX action. This flaw allows unauthenticated attackers to inject malicious PHP objects into the application.

Critical Impact
Unauthenticated attackers can exploit this PHP Object Injection vulnerability to potentially execute arbitrary code, delete files, or retrieve sensitive data if a suitable POP (Property Oriented Programming) chain exists on the target system. The theme has been removed from the repository with no patch available.

Affected Products

Puzzles | WP Magazine / Review with Store WordPress Theme versions up to and including 4.2.4
Themerex Puzzles WordPress Theme (all versions)
WordPress installations using the Puzzles theme with RTL support

Discovery Timeline

2025-02-13 - CVE-2024-13770 published to NVD
2025-02-24 - Last updated in NVD database

Technical Details for CVE-2024-13770

Vulnerability Analysis

This vulnerability represents a classic insecure deserialization flaw (CWE-502) within a WordPress theme context. The view_more_posts AJAX action accepts user-controlled input and passes it through PHP's deserialization functions without adequate validation or sanitization. When PHP deserializes untrusted data, an attacker can manipulate object properties and potentially trigger dangerous magic methods such as __wakeup(), __destruct(), or __toString().

The exploitation potential depends on the presence of a POP chain—a sequence of PHP classes with exploitable magic methods that can be chained together to achieve malicious outcomes. While the vulnerable theme itself does not contain a known POP chain, WordPress sites frequently include additional plugins and themes that may provide the necessary gadget classes to complete an attack chain.

Root Cause

The root cause of this vulnerability is the improper handling of user-supplied data in the AJAX endpoint. The view_more_posts action processes incoming data through PHP's unserialize() function without implementing proper input validation, type checking, or allowlist filtering. This violates secure coding practices that mandate treating all external input as untrusted and potentially malicious.

Attack Vector

The attack is network-based and requires no authentication or user interaction, making it highly exploitable. An attacker can craft a malicious HTTP request to the WordPress AJAX handler (wp-admin/admin-ajax.php) with the action parameter set to view_more_posts and include a serialized PHP object payload. The server-side code deserializes this payload, instantiating attacker-controlled objects.

If a compatible POP chain is present from other installed plugins or themes, the attacker can leverage this to:

Execute arbitrary PHP code on the server
Delete arbitrary files, potentially including critical WordPress configuration
Read sensitive data such as database credentials from wp-config.php
Establish persistent backdoor access to the compromised site

The attack targets the WordPress AJAX interface, which is publicly accessible at /wp-admin/admin-ajax.php, allowing exploitation from any network location without prior access to the WordPress installation.

Detection Methods for CVE-2024-13770

Indicators of Compromise

Suspicious POST requests to /wp-admin/admin-ajax.php with action=view_more_posts containing serialized PHP object strings (look for patterns like O: followed by class names)
Unexpected file modifications or deletions in the WordPress installation directory
Web server access logs showing malformed or abnormally long payloads in AJAX requests
Presence of new unknown PHP files in theme or upload directories indicating webshell deployment

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in request parameters
Monitor WordPress AJAX endpoints for anomalous request patterns, particularly those targeting the view_more_posts action
Deploy file integrity monitoring on critical WordPress files to detect unauthorized modifications
Review web server logs for requests containing serialized object notation (O: prefix followed by integers and class names)

Monitoring Recommendations

Enable detailed logging for all WordPress AJAX requests and regularly audit for suspicious patterns
Configure intrusion detection systems to alert on PHP object injection attack signatures
Monitor for new file creation events in the WordPress installation, especially PHP files outside normal update patterns
Implement real-time alerting for any access attempts to the vulnerable AJAX action from external IP addresses

How to Mitigate CVE-2024-13770

Immediate Actions Required

Remove the Puzzles theme immediately from all WordPress installations as no security patch is available
Migrate to an actively maintained alternative WordPress magazine/review theme
Audit the WordPress installation for signs of compromise including unauthorized files, modified core files, and suspicious database entries
Review all installed plugins and themes for potential POP chain gadgets that could be leveraged in conjunction with this vulnerability

Patch Information

The developer has opted to remove the Puzzles theme from the ThemeForest repository, and no security patch has been released. The official recommendation is to discontinue use of this theme and migrate to alternative software. Users should refer to the Wordfence Vulnerability Report for the latest information and the ThemeForest Product Page for any vendor updates.

Workarounds

Block AJAX requests containing the view_more_posts action at the web server or WAF level until the theme can be replaced
Implement a custom WordPress filter or plugin to intercept and neutralize requests to the vulnerable endpoint
Restrict access to wp-admin/admin-ajax.php from untrusted networks if feasible for your deployment
Consider placing the site in maintenance mode during migration to prevent exploitation

bash

# Apache .htaccess rule to block the vulnerable AJAX action
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$ [NC]
RewriteCond %{QUERY_STRING} action=view_more_posts [NC,OR]
RewriteCond %{REQUEST_BODY} action=view_more_posts [NC]
RewriteRule .* - [F,L]
</IfModule>