CVE-2024-24799 Overview
CVE-2024-24799 is a Missing Authorization vulnerability [CWE-862] in the WooCommerce Box Office plugin for WordPress. The flaw affects all versions of WooCommerce Box Office up to and including 1.2.2. Authenticated attackers with low privileges can abuse plugin actions that fail to enforce proper capability or ownership checks. Successful exploitation compromises confidentiality, integrity, and availability of ticket data and related site records. The vulnerability is exploitable over the network with low attack complexity and no user interaction. Patchstack published the advisory with an assigned CVSS 3.1 score of 8.8.
Critical Impact
Authenticated attackers can bypass access controls in WooCommerce Box Office to read, modify, or delete ticket-related data belonging to other users.
Affected Products
- WooCommerce Box Office plugin for WordPress, versions up to and including 1.2.2
- WordPress sites running the vulnerable plugin as part of a WooCommerce storefront
- Any environment shipping the plugin bundled with WooCommerce ticketing workflows
Discovery Timeline
- 2024-03-26 - CVE-2024-24799 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-24799
Vulnerability Analysis
WooCommerce Box Office extends WooCommerce with ticket product creation, attendee capture, and ticket management. The plugin exposes actions that operate on ticket records and attendee metadata. In versions through 1.2.2, one or more of these actions do not verify whether the requesting user is authorized to act on the target object. An authenticated user with a low-privilege role, such as a customer created through standard WooCommerce checkout, can invoke the action against tickets owned by other users. The action then executes without a capability check or ownership validation, granting broad access to tickets across the store.
The consequences map directly to the high impact ratings on confidentiality, integrity, and availability. Attackers can disclose attendee information tied to purchased tickets, modify ticket fields to alter attendee identity, or delete tickets to disrupt event operations. The EPSS probability for CVE-2024-24799 is 0.504%.
Root Cause
The root cause is missing authorization on privileged plugin actions. The affected handlers rely on authentication alone and do not call WordPress capability checks such as current_user_can() or verify that the target ticket belongs to the requesting user. This aligns with CWE-862: Missing Authorization.
Attack Vector
An attacker registers or uses an existing low-privilege WordPress account on the target store. The attacker then issues a crafted HTTP request to the vulnerable plugin endpoint, targeting a ticket identifier owned by another customer. Because the handler skips the authorization check, the action succeeds and returns or mutates data outside the attacker's own scope.
See the Patchstack Vulnerability Database Entry for advisory details.
Detection Methods for CVE-2024-24799
Indicators of Compromise
- Unexpected changes to ticket records, attendee names, or ticket metadata that were not initiated by the ticket owner or a store administrator.
- Access logs showing authenticated admin-ajax.php or REST requests to Box Office actions from low-privilege customer accounts.
- Ticket deletions or bulk modifications that do not correspond to legitimate order refunds or admin activity.
Detection Strategies
- Inventory WordPress installations and confirm whether the WooCommerce Box Office plugin version is 1.2.2 or earlier.
- Review WooCommerce order notes and Box Office ticket audit records for edits performed by user IDs that do not own the corresponding order.
- Correlate web server access logs with ticket modification timestamps to identify requests from customer-role accounts against tickets they do not own.
Monitoring Recommendations
- Enable verbose logging on admin-ajax.php and REST endpoints exposed by the plugin, and forward logs to a centralized SIEM.
- Alert on high-frequency requests from a single authenticated customer account against ticket-related actions.
- Track new user registrations followed shortly by ticket-modification activity, which is a common exploitation pattern for broken access control.
How to Mitigate CVE-2024-24799
Immediate Actions Required
- Update WooCommerce Box Office to a version later than 1.2.2 as soon as the vendor-supplied patched release is available.
- Audit user roles and remove unused or unnecessary customer accounts that could be leveraged as authenticated attackers.
- Review recent ticket, order, and attendee changes for unauthorized modifications and restore from backups where needed.
Patch Information
Refer to the Patchstack Vulnerability Database Entry for the current fixed version guidance for WooCommerce Box Office. Apply the vendor update through the WordPress plugin manager or WP-CLI once available, and validate the installed version after upgrade.
Workarounds
- Temporarily deactivate the WooCommerce Box Office plugin if ticket sales can be paused until a fix is applied.
- Restrict access to admin-ajax.php and the plugin's REST routes using a web application firewall rule that blocks Box Office actions from non-administrator sessions.
- Disable open customer registration on the store to reduce the population of low-privilege accounts that can reach the vulnerable endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
