CVE-2024-1380: Relevanssi WordPress Auth Bypass Flaw

CVE-2024-1380 Overview

The Relevanssi – A Better Search plugin for WordPress contains an authorization bypass vulnerability due to a missing capability check on the relevanssi_export_log_check() function. This flaw affects all versions up to and including 4.22.0, allowing unauthenticated attackers to export sensitive query log data without proper authorization.

Critical Impact

Unauthenticated attackers can exploit this missing authorization check to export search query logs, potentially exposing sensitive user search patterns, behavioral data, and information about site content that users are searching for.

Affected Products

• Relevanssi – A Better Search plugin for WordPress versions up to and including 4.22.0
• WordPress installations using vulnerable Relevanssi plugin versions
• Sites with Relevanssi query logging enabled

Discovery Timeline

• 2024-03-13 - CVE-2024-1380 published to NVD
• 2025-01-31 - Last updated in NVD database

Technical Details for CVE-2024-1380

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a broken access control flaw that occurs when a web application does not perform authorization checks for a function that requires specific privileges. In this case, the relevanssi_export_log_check() function fails to verify whether the requesting user has appropriate capabilities before allowing access to export functionality.

The vulnerability allows network-based attacks with low complexity and requires no privileges or user interaction. The impact is limited to confidentiality exposure, as attackers can only read data but cannot modify or delete information. WordPress plugins that handle logging functionality are particularly sensitive targets because query logs often contain insights into user behavior, internal content structures, and potentially sensitive search terms.

Root Cause

The root cause of this vulnerability lies in the absence of WordPress capability checks within the relevanssi_export_log_check() function. WordPress provides a robust authorization framework through functions like current_user_can() that developers should use to verify user permissions before executing privileged operations. The vulnerable function processes export requests without first validating that the requester possesses administrative or appropriate user-level capabilities to access log data.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker can directly access the export functionality endpoint to retrieve search query logs. Since no authentication or authorization is required, any remote attacker who can reach the WordPress site can potentially exploit this vulnerability to extract logged search data.

The exploitation process involves making requests to the plugin's export functionality endpoint. Without proper capability verification, the function processes the request and returns query log data that should only be accessible to site administrators.

Detection Methods for CVE-2024-1380

Indicators of Compromise

• Unusual access attempts to Relevanssi plugin export endpoints from unauthenticated sessions
• Unexpected spikes in requests targeting WordPress AJAX handlers related to log exports
• Access logs showing repeated calls to relevanssi_export_log_check functionality from external IPs
• Large data transfers from the WordPress installation that correlate with log export operations

Detection Strategies

• Monitor WordPress access logs for requests to Relevanssi export endpoints from unauthenticated users
• Implement Web Application Firewall (WAF) rules to detect and block suspicious export requests
• Review server logs for patterns indicating automated scanning or exploitation attempts against plugin endpoints
• Configure alerting for any successful log export operations that don't originate from authenticated admin sessions

Monitoring Recommendations

• Enable detailed logging on WordPress installations to capture all plugin-related requests
• Implement real-time monitoring for access to sensitive plugin functions and endpoints
• Set up alerts for bulk data exports or unusual access patterns to logging functionality
• Regularly audit access logs for evidence of unauthorized data access attempts

How to Mitigate CVE-2024-1380

Immediate Actions Required

• Update the Relevanssi plugin to the latest available version that addresses this vulnerability
• Review WordPress access logs for any signs of prior exploitation
• Consider temporarily disabling query logging in Relevanssi until the plugin is updated
• Implement WAF rules to restrict access to plugin export functionality

Patch Information

The vendor has addressed this vulnerability. Security updates are available through the official WordPress plugin repository. The patch changeset can be reviewed at the WordPress Plugin Changeset. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Site administrators should update the plugin immediately through the WordPress dashboard or by downloading the latest version from the WordPress plugin repository.

Workarounds

• Restrict access to WordPress admin-ajax.php at the server level using IP whitelisting for administrative functions
• Implement additional authentication layers through security plugins that can enforce capability checks
• Disable Relevanssi query logging feature temporarily if immediate patching is not possible
• Use a WAF to block unauthenticated requests to export-related endpoints

# Apache configuration example to restrict access to admin-ajax.php
<Files admin-ajax.php>
    Order deny,allow
    Deny from all
    # Allow from trusted admin IP addresses
    Allow from 192.168.1.100
    # Allow WordPress core AJAX functionality
    <If "%{REQUEST_METHOD} == 'POST' && %{HTTP:X-Requested-With} == 'XMLHttpRequest'">
        Allow from all
    </If>
</Files>