CVE-2024-1710: Unlimited Elements Auth Bypass Vulnerability

CVE-2024-1710 Overview

CVE-2024-1710 affects the Addon Library plugin for WordPress in all versions up to and including 1.3.76. The plugin fails to perform capability checks on the onAjaxAction function, allowing authenticated users with subscriber-level access to invoke privileged actions. Attackers can abuse this flaw to upload arbitrary files to affected WordPress sites. The issue is tracked under [CWE-862] (Missing Authorization) and carries a CVSS score of 8.8.

Critical Impact
Authenticated attackers with subscriber-level privileges can upload arbitrary files, enabling remote code execution and full site compromise on WordPress installations running vulnerable versions of the Addon Library plugin.

Affected Products

Unlimited-Elements Addon Library plugin for WordPress, versions up to and including 1.3.76
WordPress sites permitting subscriber-level user registration with the plugin installed
CPE: cpe:2.3:a:unlimited-elements:addon_library:*:*:*:*:*:wordpress:*:*

Discovery Timeline

2024-02-26 - CVE-2024-1710 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1710

Vulnerability Analysis

The Addon Library plugin exposes an AJAX handler through the onAjaxAction function defined in unitecreator_actions.class.php. The handler routes multiple sub-actions but omits a capability check that would restrict privileged operations to administrators. Any authenticated user, including a subscriber, can reach the vulnerable code path and trigger actions such as arbitrary file uploads.

Successful exploitation lets an attacker place executable files inside the WordPress installation. Once a PHP payload is written to a web-accessible location, the attacker can request the file to achieve remote code execution. This typically leads to full site takeover, database exfiltration, and pivoting into adjacent infrastructure.

Root Cause

The root cause is a missing authorization check [CWE-862]. The onAjaxAction dispatcher accepts requests from any authenticated session and does not validate the caller's WordPress role or capability before executing sensitive sub-actions. Because WordPress permits open registration on many sites, the attacker prerequisite of a subscriber account is trivially satisfied.

Attack Vector

The attack is remote and network-based over standard HTTP/HTTPS. An attacker registers or acquires a subscriber account, then sends a crafted AJAX POST request to the WordPress admin-ajax.php endpoint invoking the vulnerable action. The request includes attacker-controlled file content and metadata, which the plugin writes to disk without capability validation. Technical details are documented in the WordPress Addon Library source code and the Wordfence Vulnerability Report.

// No verified exploit code is publicly available.
// Exploitation involves an authenticated POST to admin-ajax.php
// invoking the onAjaxAction handler with a file-upload sub-action.

Detection Methods for CVE-2024-1710

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php from low-privilege user sessions referencing Addon Library action names
New PHP files appearing under wp-content/uploads/ or plugin directories with recent modification timestamps
Outbound network connections from the web server to unfamiliar hosts shortly after file upload activity
Creation of new administrator accounts or unexpected changes to WordPress user roles

Detection Strategies

Review web server access logs for authenticated admin-ajax.php requests tied to the Addon Library plugin from subscriber accounts
Deploy WordPress security plugins with rules covering CVE-2024-1710 to block exploitation attempts at the application layer
Monitor filesystem integrity on wp-content/ directories to detect unauthorized file writes

Monitoring Recommendations

Alert on any PHP file creation events within WordPress upload directories, which should not normally contain executable code
Track subscriber-level account registration spikes correlated with subsequent AJAX activity
Forward WordPress and web server logs to a centralized SIEM for correlation across authentication, upload, and process-execution events

How to Mitigate CVE-2024-1710

Immediate Actions Required

Update the Addon Library plugin to a version later than 1.3.76 on every affected WordPress site
Audit existing plugin directories and wp-content/uploads/ for unauthorized PHP files and remove any suspicious artifacts
Review the WordPress user list and revoke any unexpected subscriber or administrator accounts created since installation of the vulnerable plugin

Patch Information

Upgrade the Addon Library plugin to a release beyond 1.3.76 that introduces the missing capability check on the onAjaxAction handler. Refer to the Wordfence Vulnerability Report for the fixed version reference and confirm the patched build through the WordPress plugin repository before deployment to production.

Workarounds

Deactivate and remove the Addon Library plugin until patching is complete if an immediate update is not possible
Disable open user registration in WordPress settings to remove the trivial path for attackers to obtain subscriber accounts
Restrict access to wp-admin/admin-ajax.php behind a web application firewall rule that blocks the vulnerable action parameters
Configure the web server to deny PHP execution within wp-content/uploads/ to limit impact of any successful file write

bash

# Example nginx configuration to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}