CVE-2024-13776 Overview
CVE-2024-13776 affects the ZoomSounds WordPress Wave Audio Player with Playlist plugin. All versions up to and including 6.91 contain a missing capability check on the dzsap_delete_notice AJAX action. Authenticated attackers with Subscriber-level access or higher can update WordPress option values without authorization. The plugin exposes several other functions with the same missing authorization flaw [CWE-862].
Attackers can modify option values to seen, trigger site errors, or enable settings such as user registration. This can result in denial of service for legitimate users.
Critical Impact
Subscriber-level attackers can modify site options, enable unwanted registration flows, and cause denial of service on affected WordPress installations.
Affected Products
- DigitalZoomStudio ZoomSounds WordPress plugin, all versions through 6.91
- WordPress sites running the ZoomSounds Wave Audio Player with Playlist
- Sites permitting Subscriber-level or higher account registration
Discovery Timeline
- 2025-04-05 - CVE-2024-13776 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13776
Vulnerability Analysis
The ZoomSounds plugin registers the dzsap_delete_notice AJAX action without verifying user capabilities. Any authenticated user, including Subscribers, can invoke the handler and change WordPress option values to seen. WordPress ties Subscriber accounts to low-privilege users, so the check gap directly exposes site configuration to modification.
The vulnerability class is Missing Authorization [CWE-862]. The advisory notes several additional plugin functions exhibit the same flaw, broadening the attack surface beyond a single AJAX endpoint. Attackers do not need to escape sandboxing, chain further bugs, or bypass nonces beyond authenticated session tokens.
Root Cause
The root cause is the absence of a current_user_can() capability check inside the AJAX handlers. WordPress requires plugin developers to gate privileged actions behind capability verification. ZoomSounds relies only on the nonce and authentication state, treating any logged-in user as authorized to modify options.
Attack Vector
Exploitation requires network access to the target site and an authenticated account at Subscriber level or above. An attacker sends a crafted admin-ajax.php POST request invoking the vulnerable action. The handler updates the target option value, which can flip flags such as user registration enablement or write values that produce fatal errors during page rendering. Repeated or targeted writes deny service to legitimate visitors.
No verified public exploit code is available. Refer to the Wordfence Vulnerability Report for technical specifics.
Detection Methods for CVE-2024-13776
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php with action=dzsap_delete_notice originating from Subscriber-level accounts
- Unexpected changes to WordPress wp_options entries, particularly options set to the string seen
- Sudden activation of the users_can_register option without administrator action
- Site errors or white-screen conditions correlated with recent option modifications
Detection Strategies
- Enable WordPress audit logging to capture all update_option calls with user attribution
- Alert on AJAX actions containing dzsap_ invoked by non-administrator accounts
- Baseline expected wp_options values and flag deviations for review
Monitoring Recommendations
- Monitor web server access logs for repeated POSTs to admin-ajax.php from single authenticated sessions
- Track new user registrations that align with unexpected option changes
- Correlate plugin AJAX activity with subsequent site availability incidents
How to Mitigate CVE-2024-13776
Immediate Actions Required
- Update the ZoomSounds plugin to a version later than 6.91 once the vendor releases a fix
- Audit existing user accounts and remove unnecessary Subscriber-level access
- Review wp_options values for unauthorized changes and restore known-good settings
- Disable open user registration until a patched version is deployed
Patch Information
The vendor advisory referenced in the Wordfence Vulnerability Report tracks fix status. Confirm the installed version exceeds 6.91 before considering the site remediated. Product details are available on the CodeCanyon Product Overview.
Workarounds
- Deactivate the ZoomSounds plugin until a patched release is installed
- Restrict admin-ajax.php access to authenticated administrators using a web application firewall rule targeting the dzsap_delete_notice action
- Set users_can_register to 0 and monitor for unauthorized changes
- Enforce least privilege by limiting new account creation to trusted flows
# Configuration example: disable open registration and verify option state via WP-CLI
wp option update users_can_register 0
wp option get users_can_register
wp plugin deactivate zoomsounds
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
