CVE-2024-13800 Overview
CVE-2024-13800 affects the ConvertPlus plugin for WordPress across all versions up to and including 3.5.30. The vulnerability stems from a missing capability check on the cp_dismiss_notice AJAX endpoint. Authenticated attackers with Subscriber-level access or higher can update arbitrary WordPress option values to 1. This unauthorized modification can trigger site errors, deny service to legitimate users, or enable settings such as user registration. The flaw maps to [CWE-862] Missing Authorization and carries an EPSS probability of 0.461%.
Critical Impact
Any authenticated Subscriber can flip WordPress options to 1, breaking site functionality or enabling registration without administrator consent.
Affected Products
- ConvertPlus (ConvertPlug) for WordPress — all versions through 3.5.30
- WordPress sites using the vulnerable cp_dismiss_notice AJAX handler
- Any site permitting Subscriber-level registrations while running the affected plugin
Discovery Timeline
- 2025-02-12 - CVE-2024-13800 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13800
Vulnerability Analysis
The ConvertPlus plugin registers an AJAX action named cp_dismiss_notice intended to let administrators dismiss admin notices. The handler updates a WordPress option value but omits a current_user_can() capability check. Any authenticated user, including low-privilege Subscribers, can invoke the endpoint and pass an arbitrary option name.
Because the handler unconditionally writes the value 1 to the specified option, an attacker can target sensitive options such as users_can_register. Setting that option to 1 opens self-service registration on the site. Attackers can also overwrite options that WordPress core or other plugins expect to contain structured data, producing fatal errors and denial of service.
Root Cause
The root cause is a broken access control pattern in the AJAX handler. The plugin relies on wp_ajax_ action registration, which only confirms that the requester is authenticated. It does not verify that the caller holds the manage_options capability or a comparable privilege before calling update_option().
Attack Vector
Exploitation requires an authenticated session at Subscriber level or above. The attacker sends a POST request to /wp-admin/admin-ajax.php with action=cp_dismiss_notice and a controlled option-name parameter. The server writes 1 to the option and returns success. No user interaction, social engineering, or additional privilege is required. Full technical detail is available in the Wordfence Vulnerability Analysis.
Detection Methods for CVE-2024-13800
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php containing action=cp_dismiss_notice from non-administrator accounts
- Unexpected changes to the users_can_register option or the default_role setting
- Sudden PHP fatal errors or white-screen conditions correlating with option writes
- New Subscriber account registrations following AJAX activity from existing low-privilege users
Detection Strategies
- Audit the wp_options table for options whose values have changed to 1 outside of administrator sessions
- Correlate web server access logs with WordPress user roles to flag Subscriber-issued AJAX calls to plugin endpoints
- Deploy WordPress activity logging to record calls to update_option() with caller identity
Monitoring Recommendations
- Alert on any invocation of cp_dismiss_notice originating from accounts without manage_options
- Monitor for spikes in new user registrations, which may indicate users_can_register was toggled
- Track HTTP 200 responses to admin-ajax.php from low-privilege session cookies
How to Mitigate CVE-2024-13800
Immediate Actions Required
- Update the ConvertPlus plugin to a version later than 3.5.30 once the vendor releases a fix
- Restrict Subscriber-level registrations on sites where they are not operationally required
- Review the wp_options table for unauthorized changes and restore known-good values
- Rotate administrator credentials if unauthorized option changes are detected
Patch Information
No fixed version is listed in the NVD entry at the time of publication. Consult the Wordfence Vulnerability Analysis and the ConvertPlug Product Overview for updated patch availability.
Workarounds
- Deactivate the ConvertPlus plugin until a patched version is available
- Use a Web Application Firewall (WAF) rule to block requests where action=cp_dismiss_notice originates from non-administrator sessions
- Disable open user registration by ensuring users_can_register remains 0 and monitor the option for changes
- Apply the principle of least privilege by removing unused low-privilege accounts
# WAF rule concept: block cp_dismiss_notice AJAX calls at the edge
# Example ModSecurity rule
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
"chain,phase:2,deny,status:403,id:1013800,msg:'Block CVE-2024-13800 ConvertPlus cp_dismiss_notice'"
SecRule ARGS:action "@streq cp_dismiss_notice" "t:lowercase"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
