CVE-2024-32681: Prime Slider Auth Bypass Vulnerability

CVE-2024-32681 Overview

CVE-2024-32681 is a missing authorization vulnerability in the BdThemes Prime Slider – Addons For Elementor plugin for WordPress. The issue affects all versions of the plugin from initial release through 3.13.2. Authenticated attackers with low-privilege access can abuse missing capability checks to perform actions outside their intended permission scope. The vulnerability is tracked under CWE-862: Missing Authorization and was published to the National Vulnerability Database (NVD) on April 22, 2024.

Critical Impact
Authenticated users with minimal privileges can access restricted plugin functionality, leading to compromise of confidentiality, integrity, and availability of the WordPress site.

Affected Products

BdThemes Prime Slider – Addons For Elementor (Free) versions up to and including 3.13.2
WordPress installations running the vulnerable plugin
Sites configured to allow contributor or subscriber-level accounts

Discovery Timeline

2024-04-22 - CVE-2024-32681 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32681

Vulnerability Analysis

The Prime Slider plugin exposes plugin functionality without validating whether the requesting user holds the required capability. WordPress plugins are expected to call current_user_can() or verify nonce and capability pairs before executing sensitive actions. Prime Slider omits these checks in one or more request handlers through version 3.13.2.

An authenticated attacker sends crafted requests to the vulnerable endpoints and executes actions reserved for higher-privileged roles. Because the plugin integrates with Elementor and manipulates page content, successful exploitation can result in modification of site data or injection of attacker-controlled content. The Patchstack advisory classifies the issue as broken access control affecting the plugin's administrative surface.

Root Cause

The root cause is missing authorization logic in plugin request handlers. Prime Slider registers AJAX or admin-post actions that are reachable by any authenticated user. The handlers do not verify user capability before performing privileged operations, violating the principle of least privilege ([CWE-862]).

Attack Vector

The attack vector is network-based and requires low-level authentication such as a contributor or subscriber account. No user interaction is required beyond the attacker submitting requests to the vulnerable plugin endpoints. Refer to the Patchstack Vulnerability Report for technical details on the affected handlers.

Detection Methods for CVE-2024-32681

Indicators of Compromise

Unexpected POST requests to WordPress AJAX endpoints (/wp-admin/admin-ajax.php) from low-privileged user sessions targeting Prime Slider actions
New or modified Elementor templates and slider content created outside normal editorial workflows
Creation of unauthorized posts, pages, or slider entries by contributor or subscriber accounts

Detection Strategies

Inventory WordPress installations and confirm the installed version of the Prime Slider plugin against version 3.13.2
Review web server access logs for anomalous request patterns to plugin-specific endpoints containing prime_slider or bdt_ action parameters
Correlate WordPress audit logs with user role assignments to identify capability mismatches

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture role changes, content modifications, and AJAX action invocations
Forward WordPress and web server logs to a centralized SIEM for correlation with authentication events
Alert on any content modification performed by accounts below the editor role

How to Mitigate CVE-2024-32681

Immediate Actions Required

Update the BdThemes Prime Slider plugin to the version released after 3.13.2 that addresses this issue
Audit all WordPress user accounts and remove unused contributor or subscriber accounts
Enforce strong password and multi-factor authentication policies for every authenticated role

Patch Information

BdThemes released a fixed version of the Prime Slider plugin subsequent to 3.13.2. Administrators should update the plugin through the WordPress plugin dashboard or by manually replacing the plugin directory with the latest release. Consult the Patchstack Vulnerability Report for the specific fixed version.

Workarounds

Deactivate the Prime Slider plugin until the patched version can be deployed
Restrict user registration and set the default new user role to Subscriber while limiting subscriber capabilities
Deploy a Web Application Firewall (WAF) rule that blocks requests to Prime Slider AJAX actions from non-administrative sessions

bash

# Update Prime Slider using WP-CLI
wp plugin update bdthemes-prime-slider-lite

# Verify the installed plugin version
wp plugin get bdthemes-prime-slider-lite --field=version

# Temporarily deactivate the plugin if a patched version is unavailable
wp plugin deactivate bdthemes-prime-slider-lite