CVE-2024-32683: Wpmet Wp Ultimate Review Auth Bypass Flaw

CVE-2024-32683 Overview

CVE-2024-32683 is an Insecure Direct Object Reference (IDOR) vulnerability in the Wpmet Wp Ultimate Review plugin for WordPress. The flaw allows unauthenticated attackers to bypass authorization controls by manipulating user-controlled keys in plugin requests. The vulnerability affects all versions of Wp Ultimate Review from initial release through 2.2.5. The weakness is classified under [CWE-639] Authorization Bypass Through User-Controlled Key. Successful exploitation leads to unauthorized disclosure of confidential data managed by the plugin.

Critical Impact
Unauthenticated network attackers can access confidential review data by manipulating object identifiers, breaking the plugin's access control boundary.

Affected Products

Wpmet Wp Ultimate Review plugin for WordPress
All versions from initial release through 2.2.5
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2024-04-19 - CVE-2024-32683 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-32683

Vulnerability Analysis

The vulnerability stems from improper authorization enforcement in the Wp Ultimate Review plugin. The plugin accepts object identifiers from client-supplied parameters without validating that the requesting user owns or is authorized to access the referenced object. This pattern, known as Insecure Direct Object Reference (IDOR), allows attackers to enumerate or directly request resources outside their permission scope.

The attack requires no authentication, no user interaction, and is exploitable over the network with low complexity. The impact is limited to confidentiality: integrity and availability of the WordPress site remain unaffected. Attackers can retrieve review data, submission metadata, or other plugin-managed records that should be access-restricted.

Root Cause

The root cause is the plugin's reliance on user-controlled keys, such as numeric identifiers passed in request parameters, without performing ownership or capability checks. WordPress plugins commonly fail to call current_user_can() or verify nonces before returning object-scoped data. The Wp Ultimate Review plugin through version 2.2.5 exhibits this missing-authorization pattern in endpoints that handle review records.

Attack Vector

An attacker crafts HTTP requests to the plugin's endpoints, substituting object identifiers to reference records belonging to other users or restricted contexts. Because the endpoint does not validate authorization against the supplied key, the server returns the requested data. No credentials, tokens, or session state are required. See the Patchstack Vulnerability Report for technical details.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose because no sanitized exploit code has been released by the reporting party.

Detection Methods for CVE-2024-32683

Indicators of Compromise

Anomalous sequential or enumerated values in request parameters targeting Wp Ultimate Review endpoints (for example, id=1, id=2, id=3 in rapid succession).
Unauthenticated HTTP requests to plugin AJAX or REST routes returning data tied to specific review records.
Spikes in 200 OK responses from plugin endpoints originating from a single IP address without prior authentication cookies.

Detection Strategies

Inspect web server access logs for high-volume requests to URIs containing wp-ultimate-review or related plugin slugs with varying numeric IDs.
Deploy WordPress audit logging to capture access to plugin-managed objects and flag requests that bypass user authentication.
Correlate WAF logs against the plugin's known request patterns to identify IDOR-style parameter manipulation.

Monitoring Recommendations

Monitor outbound responses for unexpected disclosure of review data fields, such as email addresses or private comments.
Alert on unauthenticated session activity touching plugin REST endpoints registered by Wp Ultimate Review.
Track plugin version inventory across managed WordPress sites and flag any instance running 2.2.5 or earlier.

How to Mitigate CVE-2024-32683

Immediate Actions Required

Identify all WordPress installations running Wp Ultimate Review version 2.2.5 or earlier and prioritize them for patching.
Update the plugin to a version released after 2.2.5 that contains the vendor's authorization fix.
If patching is not immediately possible, deactivate and remove the plugin until the update can be applied.

Patch Information

Wpmet has addressed the issue in a release following version 2.2.5. Site administrators should update Wp Ultimate Review through the WordPress plugin dashboard or by replacing the plugin files with the latest version from the official repository. Refer to the Patchstack Vulnerability Report for current patch guidance.

Workarounds

Restrict access to the plugin's AJAX and REST endpoints at the web server or WAF layer until the patch is applied.
Apply a virtual patch via a WordPress security plugin or WAF rule that blocks unauthenticated requests to Wp Ultimate Review object handlers.
Limit plugin functionality to authenticated users only through web server access controls where feasible.

bash

# Example WAF rule to block unauthenticated access to plugin endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/wp-ultimate-review/" \
  "id:1003268,phase:1,deny,status:403,\
   chain,msg:'Block unauth access to Wp Ultimate Review endpoints'"
  SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"