CVE-2024-30235: Multiple Page Generator Auth Bypass Flaw

CVE-2024-30235 Overview

CVE-2024-30235 is a Missing Authorization vulnerability [CWE-862] in the Themeisle Multiple Page Generator Plugin (MPG) for WordPress. The flaw affects all versions of the plugin up to and including 3.4.0. Authenticated attackers with low-level privileges can access plugin functionality that should be restricted to higher-privileged roles. Successful exploitation compromises confidentiality, integrity, and availability of the affected WordPress site.

Critical Impact
Authenticated users with minimal privileges can invoke MPG plugin actions without proper authorization checks, enabling data manipulation and site compromise on WordPress installations running vulnerable versions.

Affected Products

Themeisle Multiple Page Generator Plugin – MPG versions up to and including 3.4.0
WordPress sites with the multiple-pages-generator-by-porthas plugin installed
All installations that permit user registration or expose low-privileged accounts

Discovery Timeline

2024-03-26 - CVE-2024-30235 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30235

Vulnerability Analysis

The Multiple Page Generator (MPG) plugin exposes plugin actions without verifying that the requesting user holds the required capabilities. This is a Broken Access Control condition classified under CWE-862: Missing Authorization. Any authenticated user, including subscriber-level accounts, can invoke functionality intended for administrators.

The attack requires network access and low privileges, with no user interaction. Because MPG is designed to generate and manage WordPress pages programmatically, unauthorized access to its actions permits creation, modification, or deletion of site content. Attackers can leverage the flaw to pivot toward broader site compromise on affected WordPress instances.

Root Cause

The root cause is the absence of capability checks (current_user_can()) and nonce verification on privileged plugin endpoints. The plugin registers AJAX or admin-post handlers that execute sensitive operations without validating whether the authenticated caller is authorized. Any registered user session satisfies the authentication requirement, bypassing the intended role-based restriction.

Attack Vector

Exploitation occurs over the network against the WordPress admin-ajax or admin-post interface. An attacker registers or compromises a low-privileged WordPress account, then issues HTTP requests to the vulnerable MPG action handlers. Because authorization is missing, the plugin executes the requested operation. Full technical write-up is available in the Patchstack Vulnerability Advisory.

No public proof-of-concept code is available at this time. The vulnerability mechanism is described in prose based on the vendor advisory. See the Patchstack advisory linked above for additional technical details.

Detection Methods for CVE-2024-30235

Indicators of Compromise

Unexpected creation, modification, or deletion of pages generated by the MPG plugin
HTTP POST requests to wp-admin/admin-ajax.php referencing MPG action names from subscriber-level accounts
New or unauthorized MPG project entries in the WordPress database
Outbound requests or scheduled tasks tied to MPG-generated content that were not created by administrators

Detection Strategies

Audit WordPress access logs for admin-ajax.php requests originating from non-administrator accounts that invoke MPG-specific action parameters
Monitor the WordPress database for unauthorized inserts or updates to MPG plugin tables
Compare running plugin versions against 3.4.0 and flag any installation at or below that version

Monitoring Recommendations

Enable WordPress audit logging to capture privilege-sensitive plugin actions and correlate them with authenticated user roles
Alert on subscriber or contributor accounts that trigger plugin administrative endpoints
Track new user registrations followed by rapid API calls to plugin endpoints as an early exploitation indicator

How to Mitigate CVE-2024-30235

Immediate Actions Required

Update the Themeisle Multiple Page Generator Plugin to a version later than 3.4.0 as soon as a fixed release is deployed
Disable or remove the MPG plugin if a patched version cannot be applied immediately
Review all existing WordPress user accounts and remove unnecessary subscriber or contributor accounts
Rotate credentials for any accounts that may have been used to exploit the vulnerability

Patch Information

Themeisle has addressed the vulnerability in a version subsequent to 3.4.0. Refer to the Patchstack Vulnerability Advisory for the fixed version and update guidance. Apply the update through the WordPress plugin manager or by replacing plugin files directly on the server.

Workarounds

Restrict user registration on the WordPress site to trusted administrators only
Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated or low-privileged access to MPG plugin action endpoints
Temporarily deactivate the MPG plugin until a patched version is installed
Enforce two-factor authentication for all WordPress accounts to reduce the risk of account compromise

bash

# Example WP-CLI commands to check and disable the vulnerable plugin
wp plugin get multiple-pages-generator-by-porthas --field=version
wp plugin deactivate multiple-pages-generator-by-porthas
wp plugin update multiple-pages-generator-by-porthas