CVE-2024-30485: XLPlugins Finale Auth Bypass Vulnerability

CVE-2024-30485 Overview

CVE-2024-30485 is a Missing Authorization vulnerability [CWE-862] in the XLPlugins Finale Lite plugin for WordPress. The flaw affects all versions up to and including 2.18.0 of the finale-woocommerce-sales-countdown-timer-discount plugin. Authenticated users with low privileges, such as subscribers, can install and activate arbitrary plugins on the target WordPress site. This capability effectively grants attackers a path to full site compromise by loading plugins with known vulnerabilities or backdoor functionality.

Critical Impact
A subscriber-level account can install and activate arbitrary WordPress plugins, leading to remote code execution and full site takeover.

Affected Products

XLPlugins Finale Lite (WordPress plugin) versions up to and including 2.18.0
Finale WooCommerce Sales Countdown Timer & Discount plugin
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2024-06-09 - CVE-2024-30485 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30485

Vulnerability Analysis

The vulnerability stems from a Missing Authorization weakness in the Finale Lite plugin. The plugin exposes AJAX endpoints that handle plugin installation and activation without validating the calling user's role or capability. WordPress convention requires that any privileged administrative action verify current_user_can() against an appropriate capability such as install_plugins or activate_plugins. The plugin's handlers do not perform this check consistently.

Any authenticated user, including a subscriber account created through open registration, can invoke these endpoints. The handler then processes the request in the context of a privileged operation and installs or activates the specified plugin. The result is arbitrary plugin installation and activation, which is functionally equivalent to arbitrary code execution on the WordPress instance.

Root Cause

The root cause is the absence of a server-side authorization check on the plugin management AJAX actions. Nonce validation, if present, does not substitute for role or capability enforcement because nonces protect against Cross-Site Request Forgery, not against privilege escalation by legitimate low-privileged users.

Attack Vector

An attacker registers or obtains a subscriber account on a target WordPress site running Finale Lite <= 2.18.0. The attacker then issues an authenticated request to the vulnerable AJAX endpoint, specifying an arbitrary plugin slug from the WordPress plugin repository. The plugin is downloaded, installed, and activated. If the attacker chooses a plugin with a known remote code execution flaw or a plugin they control, they gain code execution on the underlying server.

No verified public proof-of-concept code is available. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2024-30485

Indicators of Compromise

Unexpected plugins present in wp-content/plugins/ that were not installed by administrators
WordPress activated_plugin and installed_plugin action log entries attributed to subscriber or non-administrator accounts
Outbound HTTP requests from the web server to downloads.wordpress.org outside of routine admin sessions
New administrator accounts or modified user roles following plugin activation events

Detection Strategies

Audit the installed plugin list against a known-good baseline and flag additions not tied to an admin session
Review web server access logs for POST requests to admin-ajax.php originating from low-privileged authenticated sessions
Correlate WordPress user activity logs with file system changes under wp-content/plugins/
Alert on new PHP files written to plugin directories outside of scheduled maintenance windows

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture plugin install and activate events with user attribution
Forward web server and application logs to a centralized SIEM for correlation across authentication and file integrity events
Monitor for the creation of new user accounts with elevated capabilities following plugin activity

How to Mitigate CVE-2024-30485

Immediate Actions Required

Update Finale Lite to a version later than 2.18.0 as soon as a fixed release is available from XLPlugins
Disable open user registration or restrict registration to trusted domains until patched
Audit the current plugin inventory and remove any plugins that were not installed intentionally by administrators
Rotate credentials for all administrator accounts and review recent role changes

Patch Information

Refer to the Patchstack Vulnerability Report for the current patch status and vendor guidance. Site owners should apply the vendor update as soon as it is published and verify the plugin version reported in the WordPress admin dashboard.

Workarounds

Deactivate and remove the Finale Lite plugin until a patched version is installed
Restrict access to wp-admin/admin-ajax.php from unauthenticated and low-privileged sessions using a Web Application Firewall rule
Set the WordPress constant DISALLOW_FILE_MODS to true in wp-config.php to block plugin and theme installation site-wide
Enforce least-privilege on all user accounts and disable subscriber-level self-registration where not required

bash

# Configuration example: block plugin/theme installation in wp-config.php
define( 'DISALLOW_FILE_MODS', true );