CVE-2024-30466 Overview
CVE-2024-30466 is a missing authorization vulnerability in the OnTheGoSystems WooCommerce Multilingual & Multicurrency plugin for WordPress. The flaw affects all versions up to and including 5.3.4. Authenticated attackers with low privileges can invoke plugin functions without the required authorization checks, leading to broken access control across the site.
The weakness is classified under [CWE-862] (Missing Authorization). The vulnerability is exploitable over the network with low attack complexity and requires no user interaction, giving attackers a direct path to compromise confidentiality, integrity, and availability of the affected WordPress site.
Critical Impact
Low-privileged authenticated users can bypass authorization controls in the WooCommerce Multilingual & Multicurrency plugin (versions up to 5.3.4), enabling actions that should be restricted to higher-privileged roles.
Affected Products
- OnTheGoSystems WooCommerce Multilingual & Multicurrency plugin for WordPress
- All plugin versions from initial release through 5.3.4
- WordPress sites running the vulnerable plugin with WooCommerce enabled
Discovery Timeline
- 2024-06-09 - CVE-2024-30466 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-30466
Vulnerability Analysis
The WooCommerce Multilingual & Multicurrency plugin exposes functionality that fails to verify whether the calling user holds the required capability. Under [CWE-862], the software does not perform an authorization check when an actor attempts to access a resource or perform an action. Any authenticated user with a low-privileged role, such as a subscriber or customer, can invoke restricted plugin operations.
The missing check impacts confidentiality, integrity, and availability of the WordPress site. Attackers can read, modify, or disrupt store data managed by the multilingual and multicurrency workflows. Because the plugin integrates directly with WooCommerce, the affected surface includes product translation, currency configuration, and related e-commerce assets.
The EPSS model estimates exploitation probability at 0.351% with a percentile of 28.161. No public proof-of-concept exploit is currently listed for this CVE.
Root Cause
The root cause is the absence of capability or nonce validation on plugin endpoints that mutate or read privileged data. WordPress plugins must gate sensitive actions with current_user_can() checks and nonce verification via check_ajax_referer() or wp_verify_nonce(). In vulnerable versions up to 5.3.4, one or more actions in the plugin do not enforce these controls, treating any authenticated request as authorized.
Attack Vector
An attacker registers or uses an existing low-privileged WordPress account on a site running the vulnerable plugin. The attacker then issues HTTP requests to the exposed plugin action endpoints, typically admin-ajax.php or REST routes registered by the plugin. Because authorization is not enforced, the server executes the privileged action and returns the result. See the Patchstack Vulnerability Advisory for advisory details.
Detection Methods for CVE-2024-30466
Indicators of Compromise
- Unexpected POST requests to wp-admin/admin-ajax.php from accounts with subscriber or customer roles targeting WooCommerce Multilingual actions
- Modifications to product translations, currency settings, or plugin configuration made by non-administrator users
- New or altered plugin option values in wp_options that reference wpml or wcml keys without a corresponding administrator session
Detection Strategies
- Enable WordPress audit logging to capture authenticated user actions and correlate them with the invoking user role
- Review web server access logs for repeated calls to plugin-registered AJAX actions or REST routes from low-privileged sessions
- Alert on privilege-role mismatches where non-administrator accounts trigger plugin management actions
Monitoring Recommendations
- Ingest WordPress and web server logs into a centralized SIEM for role-aware correlation
- Track the installed version of woocommerce-multilingual across managed WordPress instances and flag any at or below 5.3.4
- Monitor for anomalous account creation followed by immediate calls to plugin endpoints
How to Mitigate CVE-2024-30466
Immediate Actions Required
- Upgrade the WooCommerce Multilingual & Multicurrency plugin to a version later than 5.3.4 as published by OnTheGoSystems
- Audit all WordPress user accounts and remove or downgrade any unnecessary low-privileged accounts that could be abused
- Review recent changes to product translations, currency configurations, and plugin options for unauthorized modifications
Patch Information
OnTheGoSystems has addressed the broken access control issue in a version subsequent to 5.3.4. Refer to the Patchstack Vulnerability Advisory for the fixed release information and vendor coordination details.
Workarounds
- Restrict access to wp-admin/admin-ajax.php and plugin REST routes through a web application firewall rule that blocks non-administrator sessions from invoking plugin-specific actions
- Disable open user registration on the affected WordPress site until the plugin is patched
- Temporarily deactivate the WooCommerce Multilingual & Multicurrency plugin if patching is not immediately possible and multilingual features are not business-critical
# Configuration example: identify vulnerable plugin installations via WP-CLI
wp plugin get woocommerce-multilingual --field=version
wp plugin update woocommerce-multilingual
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
