CVE-2024-32682: Prime Slider Auth Bypass Vulnerability

CVE-2024-32682 Overview

CVE-2024-32682 is a Missing Authorization vulnerability [CWE-862] in the BdThemes Prime Slider – Addons For Elementor WordPress plugin. The flaw affects all versions up to and including 3.13.2. Authenticated attackers with low-level privileges can invoke plugin functions that lack proper capability checks. Successful exploitation compromises confidentiality, integrity, and availability of the affected WordPress site. The Patchstack Vulnerability Analysis documents the broken access control condition.

Critical Impact
Authenticated users with minimal privileges can bypass authorization checks and perform actions restricted to higher-privileged roles, leading to full compromise of the WordPress site.

Affected Products

BdThemes Prime Slider – Addons For Elementor (Lite/Free)
Prime Slider versions from n/a through 3.13.2
WordPress installations running the affected plugin builds

Discovery Timeline

2024-04-22 - CVE-2024-32682 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32682

Vulnerability Analysis

The vulnerability originates in the Prime Slider plugin's handling of privileged actions. Plugin endpoints do not verify the requesting user's capabilities before executing sensitive operations. This is a classic Missing Authorization weakness classified as [CWE-862].

An authenticated attacker holding a low-privilege WordPress role, such as Subscriber or Contributor, can invoke these endpoints directly. Because the plugin trusts the authenticated session without checking role or capability, restricted functionality becomes accessible. The impact extends to confidentiality, integrity, and availability of site data and configuration.

Root Cause

The root cause is the absence of capability checks such as current_user_can() on plugin action handlers. The plugin also lacks nonce enforcement patterns that would restrict actions to intended workflows. Any authenticated request that reaches the vulnerable handlers is executed regardless of the caller's role.

Attack Vector

Exploitation occurs over the network against a WordPress site that exposes the plugin's action endpoints. The attacker must first authenticate, which is trivial on sites permitting user registration. After authentication, the attacker sends crafted requests to the unprotected plugin actions to trigger privileged behavior. No user interaction from an administrator is required. Refer to the Patchstack Vulnerability Analysis for advisory details.

Detection Methods for CVE-2024-32682

Indicators of Compromise

Unexpected admin-ajax.php or REST API requests referencing Prime Slider actions issued by non-administrator accounts.
New or modified Elementor widget content, template data, or slider configurations that do not correlate with administrator activity.
Recently created low-privilege accounts followed by privileged plugin actions from those accounts.

Detection Strategies

Inventory WordPress installations and identify sites running Prime Slider at or below version 3.13.2.
Review web server access logs for authenticated POST requests to plugin endpoints originating from Subscriber or Contributor sessions.
Correlate WordPress audit logs with plugin file and options changes to identify unauthorized modifications.

Monitoring Recommendations

Enable a WordPress activity log plugin to record capability-sensitive events and role changes.
Alert on newly registered users that immediately interact with plugin AJAX or REST endpoints.
Monitor outbound requests from the web server for signs of secondary exploitation following configuration tampering.

How to Mitigate CVE-2024-32682

Immediate Actions Required

Update Prime Slider – Addons For Elementor to a version later than 3.13.2 as published by BdThemes.
Audit WordPress user accounts and remove or downgrade any suspicious low-privilege users created recently.
Disable open user registration on public sites where the Subscriber role is not required.

Patch Information

BdThemes released a fix subsequent to Prime Slider 3.13.2. Administrators should apply the latest available plugin release through the WordPress plugin manager. Consult the Patchstack Vulnerability Analysis to confirm the fixed version before deployment.

Workarounds

Deactivate the Prime Slider plugin until the patched version can be installed and validated.
Restrict access to wp-admin and admin-ajax.php using a web application firewall rule limiting authenticated plugin actions to trusted roles.
Enforce least privilege by auditing role assignments and removing capabilities that are not required for daily operations.

bash

# Configuration example: WP-CLI commands to identify and mitigate exposure
wp plugin list --name=bdthemes-prime-slider-lite --fields=name,status,version
wp plugin deactivate bdthemes-prime-slider-lite
wp user list --role=subscriber --fields=ID,user_login,user_registered
wp option update users_can_register 0