CVE-2024-13801 Overview
CVE-2024-13801 affects the BWL Advanced FAQ Manager plugin for WordPress in all versions up to and including 2.1.4. The vulnerability stems from a missing capability check on the baf_set_notice_status AJAX action. Authenticated attackers with Subscriber-level access or above can update arbitrary option values to 1 on the target WordPress site. Attackers can leverage this to trigger site errors, enable unintended settings such as user registration, or cause a denial of service condition against legitimate users. The flaw is classified under CWE-862: Missing Authorization.
Critical Impact
Authenticated Subscriber-level attackers can modify WordPress option values to disrupt site availability or enable unauthorized functionality such as open registration.
Affected Products
- BWL Advanced FAQ Manager plugin for WordPress (all versions up to and including 2.1.4)
- WordPress installations exposing the plugin's AJAX endpoint
- Sites permitting Subscriber-level registration where the plugin is active
Discovery Timeline
- 2025-03-26 - CVE-2024-13801 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13801
Vulnerability Analysis
The BWL Advanced FAQ Manager plugin registers the baf_set_notice_status AJAX action to update a notice-related option in the WordPress database. The handler does not verify the caller's capabilities before writing to the options table. Any authenticated user, including low-privilege Subscribers, can invoke the action and force a target option value to 1.
The attack requires network access to the WordPress admin-ajax endpoint and low privileges with no user interaction. Impact centers on integrity and availability, as attackers can overwrite critical options that break site functionality or enable behaviors the administrator did not intend. Confidentiality is not directly affected.
Root Cause
The root cause is the absence of a current_user_can() capability check and, per the advisory, insufficient authorization enforcement on the baf_set_notice_status AJAX callback. WordPress AJAX handlers registered under wp_ajax_ are accessible to any authenticated user by default. Without an explicit capability gate, the handler treats Subscribers the same as Administrators when writing option values.
Attack Vector
An authenticated attacker sends a crafted POST request to /wp-admin/admin-ajax.php specifying action=baf_set_notice_status with an option name parameter. The handler then writes the value 1 to the specified WordPress option. Attackers can target options that control site availability, such as maintenance flags, or options that alter security posture, such as users_can_register. Refer to the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2024-13801
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php containing action=baf_set_notice_status from low-privilege user sessions.
- Unauthorized changes to wp_options values, particularly users_can_register flipped to 1, or arbitrary options newly set to 1.
- Sudden increase in Subscriber account registrations following option modifications.
- Site errors, blank pages, or broken functionality correlating with option table writes.
Detection Strategies
- Monitor WordPress access logs for authenticated requests to admin-ajax.php invoking the baf_set_notice_status action.
- Audit the wp_options table for unexpected option_value changes to 1 using file integrity or database auditing tools.
- Review WordPress user roles for unauthorized Subscriber or higher account creation after suspected exploitation.
Monitoring Recommendations
- Enable WordPress activity logging plugins to capture option changes and AJAX action calls with user attribution.
- Alert on any modification of security-sensitive options such as users_can_register, default_role, or blog_public.
- Baseline normal AJAX action frequency and flag anomalous spikes tied to baf_set_notice_status.
How to Mitigate CVE-2024-13801
Immediate Actions Required
- Deactivate the BWL Advanced FAQ Manager plugin until a patched release is confirmed and applied.
- Restrict new user registration and set the default role to Subscriber only when necessary to shrink the pool of eligible attackers.
- Audit the wp_options table and revert any unauthorized values changed to 1.
- Review user accounts and remove any suspicious Subscriber-level accounts created recently.
Patch Information
At the time of NVD publication, all versions of BWL Advanced FAQ Manager up to and including 2.1.4 are affected. Consult the vendor listing at CodeCanyon FAQ Manager and the Wordfence Vulnerability Report for the latest fixed version guidance and update to the patched release when available.
Workarounds
- Remove or disable the plugin entirely if a patched version is not yet available.
- Deploy a Web Application Firewall (WAF) rule to block requests to admin-ajax.php containing action=baf_set_notice_status from non-administrator sessions.
- Enforce least privilege and disable open registration by setting users_can_register to 0 and monitoring it for changes.
- Apply a mu-plugin that adds a capability check wrapping the vulnerable AJAX action until the vendor patch is installed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
