CVE-2024-30484: RT Easy Builder Auth Bypass Vulnerability

CVE-2024-30484 Overview

CVE-2024-30484 is a Missing Authorization vulnerability [CWE-862] affecting the RT Easy Builder – Advanced addons for Elementor WordPress plugin developed by Risethemes. The flaw affects all plugin versions up to and including 2.0. An authenticated attacker with low privileges can invoke plugin functionality without proper authorization checks, leading to compromise of confidentiality, integrity, and availability on affected WordPress sites.

Critical Impact
Authenticated attackers with low privileges can bypass access controls in RT Easy Builder for Elementor, enabling actions that impact site data and configuration on WordPress installations running version 2.0 or earlier.

Affected Products

Risethemes RT Easy Builder – Advanced addons for Elementor (WordPress plugin)
All versions from n/a through 2.0
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2024-06-04 - CVE-2024-30484 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30484

Vulnerability Analysis

The vulnerability stems from Broken Access Control in the RT Easy Builder – Advanced addons for Elementor plugin. The plugin exposes functionality that fails to verify whether the requesting user holds the required capability or role before executing sensitive operations. This authorization gap [CWE-862] permits low-privilege authenticated users to reach code paths that should be restricted to administrators or editors.

Exploitation requires network access to the WordPress site and authenticated session credentials. No user interaction beyond the attacker's own actions is required. Successful exploitation impacts confidentiality, integrity, and availability of plugin-controlled resources and, depending on the affected functions, the broader WordPress instance.

Root Cause

The plugin omits authorization checks such as current_user_can() on privileged endpoints or AJAX handlers. Missing capability checks allow requests originating from any authenticated context — including Subscriber-level accounts common on sites with open registration — to trigger actions reserved for higher-privileged roles. See the Patchstack Vulnerability Database Entry for advisory details.

Attack Vector

An attacker authenticates to the target WordPress site using any valid account, including self-registered low-privilege users. The attacker then issues HTTP requests directly to the plugin's action handlers, admin-ajax.php endpoints, or REST routes exposed by RT Easy Builder. Because authorization is not enforced server-side, the requests execute with the effect of a privileged user.

No verified public proof-of-concept is available at this time. The vulnerability mechanism is documented in prose only; refer to the vendor advisory for endpoint-specific technical details.

Detection Methods for CVE-2024-30484

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php with action parameters tied to RT Easy Builder from non-administrator user sessions.
Unauthorized modifications to Elementor templates, widgets, or plugin settings not tied to a legitimate administrator workflow.
New or modified WordPress content, options, or user accounts correlated in time with Subscriber-level authenticated requests.

Detection Strategies

Enumerate WordPress installations and identify sites running RT Easy Builder – Advanced addons for Elementor at version 2.0 or earlier.
Inspect web server access logs for authenticated requests to plugin AJAX handlers or REST endpoints originating from low-privilege user IDs.
Correlate plugin configuration or content changes against the acting user's role to surface privilege mismatches.

Monitoring Recommendations

Enable WordPress audit logging to capture user role, action, and endpoint for every administrative action.
Alert on repeated admin-ajax.php invocations from Subscriber or Contributor accounts targeting plugin-specific action values.
Forward WordPress and web server logs to a centralized SIEM or data lake for correlation with authentication events.

How to Mitigate CVE-2024-30484

Immediate Actions Required

Update RT Easy Builder – Advanced addons for Elementor to a version later than 2.0 as soon as the vendor publishes a fix; consult the Patchstack advisory for current status.
Deactivate and remove the plugin if a patched release is not yet available and the functionality is not business-critical.
Audit all WordPress user accounts and remove unused or unrecognized low-privilege users that could be leveraged for exploitation.

Patch Information

At the time of publication, no fixed version is listed in the enriched data beyond the affected range of n/a through 2.0. Monitor the vendor's plugin page and the Patchstack database entry for release of a patched version and apply the update promptly across all WordPress sites.

Workarounds

Disable open user registration in WordPress general settings to eliminate the low-privilege authenticated attacker prerequisite.
Restrict access to /wp-admin/admin-ajax.php and plugin REST routes at the web application firewall based on user role or source IP.
Enforce least privilege by reviewing existing account roles and demoting or removing accounts that do not require elevated capabilities.

bash

# Disable new user registration via WP-CLI
wp option update users_can_register 0

# List installed plugins and versions to identify affected instances
wp plugin list --format=table | grep rt-easy-builder

# Deactivate the vulnerable plugin until a patched version is available
wp plugin deactivate rt-easy-builder-advanced-addons-for-elementor