CVE-2024-32824 Overview
CVE-2024-32824 is a Missing Authorization vulnerability [CWE-862] in the Evergreen Content Poster WordPress plugin. The flaw affects all versions up to and including 1.4.2. Authenticated attackers with low-level privileges can invoke plugin functionality that should be restricted to higher-privileged roles. Successful exploitation leads to compromise of confidentiality, integrity, and availability across the WordPress installation.
The vulnerability was catalogued by Patchstack and assigned to the evergreen-content-poster plugin maintained by Evergreen Content Poster. The issue stems from broken access control in plugin request handlers that do not verify caller permissions.
Critical Impact
Authenticated low-privilege users can trigger restricted plugin actions on affected WordPress sites, resulting in full compromise of site content and configuration.
Affected Products
- Evergreen Content Poster plugin for WordPress — all versions through 1.4.2
- WordPress installations using evergreen-content-poster
- Sites allowing subscriber or higher registered users on vulnerable plugin versions
Discovery Timeline
- 2024-06-09 - CVE-2024-32824 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-32824
Vulnerability Analysis
The vulnerability is a broken access control issue in the Evergreen Content Poster plugin. Plugin endpoints exposed via WordPress AJAX or admin request handlers process actions without validating that the invoking user holds the required capability. An authenticated user with low privileges can therefore call these handlers directly and perform actions intended for administrators.
Because the plugin manages automated content posting to social platforms, abuse of these endpoints can modify plugin configuration, post arbitrary content, or manipulate stored credentials for connected services. The impact extends beyond the WordPress site itself to any linked social accounts governed by the plugin.
Root Cause
The root cause is a missing authorization check [CWE-862]. Plugin action handlers do not call WordPress capability functions such as current_user_can() before performing privileged operations. Nonce checks alone, where present, only validate request intent and do not enforce role separation between authenticated users.
Attack Vector
Exploitation requires network access to the WordPress site and any valid authenticated session. An attacker submits a crafted HTTP request to the vulnerable plugin action endpoint. The plugin executes the requested operation without verifying the caller's role, granting the attacker effective administrative control over plugin functionality. No user interaction from the site administrator is required.
No public proof-of-concept exploit is currently listed for CVE-2024-32824. See the Patchstack Vulnerability Report for additional technical detail.
Detection Methods for CVE-2024-32824
Indicators of Compromise
- Unexpected posts, drafts, or scheduled content created by non-administrative user accounts
- Changes to Evergreen Content Poster plugin settings without a corresponding administrator session
- Outbound API calls to connected social platforms originating outside normal posting schedules
- WordPress admin-ajax.php requests referencing plugin actions from subscriber-level accounts
Detection Strategies
- Review web server access logs for POST requests to admin-ajax.php with action parameters tied to the evergreen-content-poster plugin
- Correlate authenticated session identifiers with the WordPress role of the acting user to identify privilege mismatches
- Alert on plugin option updates in the wp_options table performed outside of administrator sessions
Monitoring Recommendations
- Enable WordPress audit logging to capture plugin configuration changes and content publication events
- Ingest WordPress and web server logs into a centralized platform for retention and correlation across user sessions
- Monitor creation of new user accounts, particularly self-registration events, on sites running the affected plugin
How to Mitigate CVE-2024-32824
Immediate Actions Required
- Deactivate the Evergreen Content Poster plugin on WordPress sites running version 1.4.2 or earlier until a fixed release is confirmed
- Audit existing WordPress user accounts and remove or downgrade unnecessary low-privilege accounts
- Rotate credentials and API tokens stored by the plugin for connected social platforms
- Review published content and plugin settings for unauthorized modifications
Patch Information
At the time of NVD publication, the advisory identifies affected versions through <= 1.4.2 without a listed fixed version. Administrators should consult the Patchstack Security Analysis and the plugin's WordPress.org page for the latest patched release before re-enabling the plugin.
Workarounds
- Restrict access to /wp-admin/admin-ajax.php at the web application firewall level for unauthenticated and low-privilege sessions where feasible
- Disable open user registration on affected sites to reduce the pool of authenticated attackers
- Apply virtual patching rules that block requests targeting the plugin's action handlers from non-administrator sessions
# Temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate evergreen-content-poster
# Disable open user registration until patched
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
