CVE-2024-32081: Websupporter Filter Auth Bypass Flaw

CVE-2024-32081 Overview

CVE-2024-32081 is a Missing Authorization vulnerability [CWE-862] affecting the Websupporter Filter Custom Fields & Taxonomies Light plugin for WordPress. The flaw impacts all versions up to and including 1.05. An authenticated attacker with low-level privileges can invoke plugin functionality that lacks proper capability checks, resulting in broken access control. Successful exploitation compromises the confidentiality, integrity, and availability of the affected WordPress site.

Critical Impact
Authenticated attackers with minimal privileges can bypass authorization controls in the Filter Custom Fields & Taxonomies Light plugin, potentially altering plugin data or triggering actions restricted to higher-privileged users on the WordPress site.

Affected Products

Websupporter Filter Custom Fields & Taxonomies Light plugin for WordPress
All versions from n/a through 1.05
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2024-06-09 - CVE-2024-32081 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32081

Vulnerability Analysis

The Filter Custom Fields & Taxonomies Light plugin exposes one or more actions that fail to verify the user's capability or role before executing privileged operations. This omission constitutes a Missing Authorization weakness under [CWE-862]. Because the plugin does not enforce role-based checks, requests originating from authenticated but low-privilege accounts, such as subscriber users, can reach code paths intended for administrators.

The vulnerability is exploitable over the network with low attack complexity and requires only low privileges. No user interaction is needed, and the plugin does not otherwise mitigate the flaw. This combination produces high impact on confidentiality, integrity, and availability of the WordPress installation.

Root Cause

The root cause is the absence of authorization checks such as current_user_can() in privileged plugin handlers. WordPress plugin developers must verify capabilities and validate nonces before performing state-changing actions. In this plugin, sensitive endpoints execute without validating that the caller holds the required role, allowing broken access control.

Attack Vector

An attacker first obtains any authenticated session on the WordPress site, including a self-registered subscriber account where open registration is enabled. The attacker then submits a crafted HTTP request to the plugin's unprotected endpoint. Because no authorization gate exists, the request executes with the plugin's intended administrative behavior. Refer to the Patchstack Vulnerability Advisory for technical details on the affected endpoint.

// No verified public exploit code is available.
// See the Patchstack advisory referenced above for details.

Detection Methods for CVE-2024-32081

Indicators of Compromise

Unexpected modifications to custom field or taxonomy configurations that cannot be traced to an administrator action.
HTTP POST requests to admin-ajax.php or plugin endpoints originating from low-privileged user sessions.
New or altered plugin settings recorded in the WordPress wp_options table without corresponding admin activity in access logs.

Detection Strategies

Inspect WordPress access logs for requests to Filter Custom Fields & Taxonomies Light plugin endpoints from users with the subscriber or contributor role.
Enable a WordPress audit logging plugin to track privileged actions and correlate them against the acting user's assigned capabilities.
Compare installed plugin versions against the fixed release to identify hosts still running versions 1.05 or earlier.

Monitoring Recommendations

Alert on anomalous POST volume to wp-admin/admin-ajax.php from non-administrative accounts.
Monitor WordPress user registration spikes, which can precede exploitation attempts against authenticated-only vulnerabilities.
Track outbound requests and file modifications from the WordPress host to detect follow-on activity such as web shell deployment.

How to Mitigate CVE-2024-32081

Immediate Actions Required

Update the Filter Custom Fields & Taxonomies Light plugin to a version later than 1.05 as soon as a patched release becomes available from the vendor.
Deactivate and remove the plugin if no patched version is available and the functionality is not business-critical.
Audit all WordPress user accounts and disable open self-registration unless it is required.

Patch Information

Consult the Patchstack Vulnerability Advisory for the latest vendor patch status. If no fixed version is published, treat the plugin as unpatched and rely on removal or virtual patching through a web application firewall.

Workarounds

Deploy a Web Application Firewall rule to block unauthenticated and low-privileged requests to the plugin's action handlers.
Restrict access to wp-admin/admin-ajax.php from untrusted IP ranges where administrative sessions do not originate.
Enforce the principle of least privilege by reviewing all subscriber and contributor accounts and removing unnecessary accounts.

bash

# Example: disable and remove the vulnerable plugin via WP-CLI
wp plugin deactivate filter-custom-fields-taxonomies-light
wp plugin delete filter-custom-fields-taxonomies-light