CVE-2024-32684: Wpmet Wp Ultimate Review Auth Bypass Flaw

CVE-2024-32684 Overview

CVE-2024-32684 is a missing authorization vulnerability in the Wpmet Wp Ultimate Review plugin for WordPress. The flaw affects all versions up to and including 2.2.5. Unauthenticated attackers can abuse review-related functionality because the plugin fails to enforce proper capability checks. The weakness is classified under [CWE-862] Missing Authorization. Exploitation occurs over the network with low complexity and requires no authentication or user interaction. The primary impact is to integrity, allowing attackers to manipulate review data managed by the plugin.

Critical Impact
Unauthenticated remote attackers can perform unauthorized actions against review functionality, modifying plugin-managed data without any user interaction.

Affected Products

Wpmet Wp Ultimate Review plugin for WordPress
All versions from n/a through 2.2.5
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2024-04-22 - CVE-2024-32684 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-32684

Vulnerability Analysis

The Wp Ultimate Review plugin exposes review-handling functionality without verifying that the requester holds the required capability. This is a broken access control issue classified as [CWE-862] Missing Authorization. The plugin's review endpoints accept requests and process them without checking user roles, nonces, or ownership of the affected review object.

Attackers reach the vulnerable code path over the network through standard WordPress request handlers such as admin-ajax.php or REST routes registered by the plugin. Because no privileges are required, exploitation can be automated against any WordPress site running the plugin at version 2.2.5 or earlier. The impact is limited to integrity, with no direct effect on confidentiality or availability.

Root Cause

The root cause is the absence of an authorization check before executing privileged review operations. The plugin does not call current_user_can() or validate a nonce with check_ajax_referer() prior to performing state-changing actions. Any request that reaches the handler is treated as authorized, regardless of the sender's role.

Attack Vector

An attacker sends a crafted HTTP request to the WordPress endpoint registered by Wp Ultimate Review. No authentication, session, or user interaction is required. The request invokes the review action handler and triggers an unauthorized modification of review data. Refer to the Patchstack Vulnerability Database Entry for additional technical context.

Detection Methods for CVE-2024-32684

Indicators of Compromise

Unexpected creation, modification, or deletion of reviews managed by the Wp Ultimate Review plugin.
Anonymous POST requests to admin-ajax.php referencing Wp Ultimate Review actions without a valid authenticated session.
Repeated requests from a single IP targeting plugin endpoints in a short time window.

Detection Strategies

Inventory WordPress installations and identify any site running Wp Ultimate Review at version 2.2.5 or earlier.
Inspect web server access logs for unauthenticated requests to plugin AJAX or REST endpoints.
Compare review data snapshots over time to identify unauthorized changes that do not correspond to legitimate user activity.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized logging or SIEM platform for correlation.
Alert on bursts of POST traffic to admin-ajax.php with plugin-specific action parameters from unauthenticated sources.
Track plugin version inventory across managed WordPress sites to ensure outdated installations are flagged.

How to Mitigate CVE-2024-32684

Immediate Actions Required

Update Wp Ultimate Review to a version newer than 2.2.5 as soon as the vendor releases a fixed build.
Audit existing reviews for unauthorized additions or modifications and restore from backup if tampering is detected.
Restrict network access to WordPress administrative endpoints where feasible.

Patch Information

Consult the Patchstack Vulnerability Database Entry for the latest patch status from Wpmet. Apply the vendor-supplied update through the WordPress plugin manager once it is available.

Workarounds

Deactivate and remove the Wp Ultimate Review plugin until a patched version is installed.
Deploy a Web Application Firewall (WAF) rule to block unauthenticated POST requests targeting the plugin's review action handlers.
Limit access to admin-ajax.php and plugin REST routes using server-level access controls where business logic permits.

bash

# Example WAF rule concept: block unauthenticated POSTs to plugin AJAX actions
# (adapt syntax to your WAF or web server platform)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1003268,msg:'Block unauth Wp Ultimate Review action'"
  SecRule ARGS:action "@rx (?i)wp_ultimate_review" \
      "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"