CVE-2024-30525: Move Addons Elementor Auth Bypass Flaw

CVE-2024-30525 Overview

CVE-2024-30525 is a Missing Authorization vulnerability [CWE-862] affecting the Move Addons for Elementor WordPress plugin developed by moveaddons. The flaw impacts all versions up to and including 1.2.9. Attackers can reach affected functionality over the network without authentication or user interaction. The plugin fails to enforce capability checks on sensitive operations, enabling broken access control conditions across confidentiality, integrity, and availability.

Critical Impact

Unauthenticated network-based attackers can invoke privileged plugin functionality on WordPress sites running Move Addons for Elementor 1.2.9 or earlier, leading to broken access control across the affected installation.

Affected Products

• moveaddons Move Addons for Elementor (WordPress plugin)
• All versions from initial release through 1.2.9
• WordPress sites with the plugin installed and activated

Discovery Timeline

• 2024-06-04 - CVE-2024-30525 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-30525

Vulnerability Analysis

The vulnerability stems from missing authorization checks within the Move Addons for Elementor plugin. WordPress plugins must validate user capabilities before executing privileged actions. This plugin omits those checks on one or more action handlers, allowing requests from users who lack the required role. The Patchstack advisory classifies the issue as broken access control affecting versions through 1.2.9. The flaw is reachable remotely without authentication, and exploitation does not require user interaction. Successful abuse impacts the confidentiality, integrity, and availability of plugin-managed resources on the WordPress site.

Root Cause

The root cause is the absence of capability or nonce validation in the plugin's action handlers, mapped to [CWE-862] Missing Authorization. WordPress provides current_user_can() and check_ajax_referer() primitives for enforcing access control on AJAX and admin-post endpoints. The affected handlers in Move Addons for Elementor through 1.2.9 do not invoke these checks before performing privileged operations.

Attack Vector

The attack vector is network-based with low attack complexity. An unauthenticated attacker sends a crafted HTTP request to the WordPress endpoint exposed by the plugin. Because no capability check gates the handler, the server executes the action under the privileges associated with the plugin code rather than the requester. See the Patchstack Vulnerability Report for additional context.

Detection Methods for CVE-2024-30525

Indicators of Compromise

• Unexpected HTTP POST requests to wp-admin/admin-ajax.php or wp-admin/admin-post.php referencing Move Addons action names from unauthenticated sources.
• New, modified, or deleted Elementor templates, widgets, or plugin options that do not correlate with administrator activity.
• Web server access logs showing repeated requests to plugin endpoints from a single IP without a preceding authentication flow.

Detection Strategies

• Inventory WordPress installations and identify sites running Move Addons for Elementor at version 1.2.9 or earlier.
• Inspect access logs for requests targeting the plugin's AJAX actions where the requester has no authenticated session cookie.
• Compare WordPress audit trails against expected administrator behavior to surface privileged actions invoked by anonymous sessions.

Monitoring Recommendations

• Enable a WordPress activity logging plugin to record plugin-level option changes and template modifications.
• Forward web server access logs and PHP error logs to a centralized log platform with alerting on anomalous POST volume to plugin endpoints.
• Add WAF rules that flag requests to known Move Addons action handlers originating from clients without a valid wordpress_logged_in_* cookie.

How to Mitigate CVE-2024-30525

Immediate Actions Required

• Update Move Addons for Elementor to a version later than 1.2.9 as soon as the vendor publishes a fix.
• If no fixed version is available, deactivate and remove the plugin until a patch is released.
• Review the WordPress site for unauthorized configuration changes, new administrator accounts, or modified Elementor content.

Patch Information

The NVD entry and the Patchstack Vulnerability Report identify all versions through 1.2.9 as affected. Site administrators should monitor the plugin's changelog on the WordPress plugin repository and apply the next available release that addresses broken access control.

Workarounds

• Deploy a Web Application Firewall rule that blocks unauthenticated requests to Move Addons AJAX and admin-post endpoints.
• Restrict access to wp-admin/admin-ajax.php and wp-admin/admin-post.php by IP allowlist where operationally feasible.
• Enforce least privilege on WordPress accounts and audit installed plugins to remove unused or unmaintained extensions.

# Example ModSecurity rule to block unauthenticated POSTs to Move Addons actions
SecRule REQUEST_URI "@rx /wp-admin/admin-ajax\.php" \
  "chain,phase:2,deny,status:403,id:1003052501,msg:'Block unauthenticated Move Addons action'"
  SecRule ARGS:action "@rx ^move_addons_" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"