CVE-2024-31350 Overview
CVE-2024-31350 is a missing authorization vulnerability [CWE-862] in the AWP Classifieds plugin for WordPress, developed by the AWP Classifieds Team (Strategy11). The flaw affects all versions up to and including 4.3.1. Authenticated attackers with low privileges can invoke plugin functions that lack proper capability or authorization checks. Successful exploitation impacts confidentiality, integrity, and availability of the affected WordPress site.
Critical Impact
An authenticated attacker with low privileges can bypass authorization controls in AWP Classifieds through version 4.3.1, leading to full compromise of confidentiality, integrity, and availability on the target WordPress site.
Affected Products
- Strategy11 AWP Classifieds plugin for WordPress
- All versions from initial release through 4.3.1
- WordPress sites running the vulnerable plugin under CPE cpe:2.3:a:strategy11:awp_classifieds
Discovery Timeline
- 2024-06-09 - CVE-2024-31350 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-31350
Vulnerability Analysis
CVE-2024-31350 is a broken access control issue in the AWP Classifieds WordPress plugin. The plugin exposes actions or endpoints that do not verify whether the authenticated user has sufficient privileges to perform the requested operation. Because the check is missing, low-privileged users such as subscribers can trigger functionality intended for administrators or classified owners.
The attack requires network access to the WordPress site and valid low-privilege credentials. No user interaction is needed once the attacker is authenticated. The scope remains unchanged, but the impact on confidentiality, integrity, and availability is high because the missing check exposes privileged plugin operations.
An attacker can abuse this to modify or delete classified listings, alter plugin data, or reach administrative functionality shipped by the plugin. Depending on the exposed action, this can pivot into broader site takeover through data manipulation or configuration changes.
Root Cause
The root cause is the absence of capability and nonce validation on one or more plugin actions. AWP Classifieds through version 4.3.1 fails to enforce authorization checks such as current_user_can() or a matching check_admin_referer() on sensitive requests. This maps directly to the CWE-862 (Missing Authorization) weakness class.
Attack Vector
Exploitation occurs over the network against the WordPress admin-ajax or plugin-provided endpoints. The attacker authenticates as any low-privileged WordPress user, then issues crafted HTTP requests to the vulnerable plugin actions. Because the server does not validate authorization, the requests execute with the effect of a privileged operation. See the Patchstack Vulnerability Report for advisory details.
Detection Methods for CVE-2024-31350
Indicators of Compromise
- Unexpected creation, modification, or deletion of classified listings by non-administrator accounts.
- HTTP POST requests to wp-admin/admin-ajax.php referencing AWP Classifieds actions from low-privileged sessions.
- New or altered plugin configuration entries in the wp_options table without a corresponding administrator session.
Detection Strategies
- Review WordPress activity and audit logs for actions performed by subscriber or contributor roles that should require higher privileges.
- Alert on repeated requests to AWP Classifieds endpoints originating from a single low-privileged user or IP address.
- Compare the installed plugin version against 4.3.1 and flag any host still running a vulnerable release.
Monitoring Recommendations
- Enable verbose access logging on the web server and forward logs to a centralized analytics platform for correlation.
- Monitor administrative-side plugin actions and database changes for anomalies tied to non-admin user IDs.
- Track authentication events for low-privilege accounts that suddenly interact with plugin management endpoints.
How to Mitigate CVE-2024-31350
Immediate Actions Required
- Upgrade AWP Classifieds to a version newer than 4.3.1 as published by the vendor.
- Audit existing WordPress user accounts and remove or reset credentials for unused or suspicious low-privilege users.
- Review recent classifieds activity and plugin configuration changes for signs of unauthorized modification.
Patch Information
The vendor advisory referenced by Patchstack indicates the issue affects AWP Classifieds through 4.3.1. Administrators should install the latest available release of the plugin from the WordPress plugin repository. Details are available in the Patchstack Vulnerability Report.
Workarounds
- Disable and remove the AWP Classifieds plugin until patching is possible.
- Restrict access to wp-admin/admin-ajax.php and plugin endpoints using a web application firewall rule that requires elevated roles.
- Enforce strong authentication and multi-factor authentication for all WordPress accounts to reduce the pool of usable low-privilege credentials.
# Configuration example: verify installed AWP Classifieds version and update via WP-CLI
wp plugin get another-wordpress-classifieds-plugin --field=version
wp plugin update another-wordpress-classifieds-plugin
wp plugin deactivate another-wordpress-classifieds-plugin # if patch not yet available
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
