CVE-2024-33543: WP Time Slots Auth Bypass Vulnerability

CVE-2024-33543 Overview

CVE-2024-33543 is a Missing Authorization vulnerability [CWE-862] in the CodePeople WP Time Slots Booking Form plugin for WordPress. The flaw affects all versions up to and including 1.2.06. Unauthenticated attackers can reach plugin functionality that should be restricted to authorized users, resulting in broken access control over booking data and configuration.

The vulnerability is exploitable over the network without user interaction or prior authentication. Successful exploitation impacts the integrity of booking records while leaving confidentiality and availability unaffected, according to the published CVSS vector.

Critical Impact
Unauthenticated attackers can invoke restricted plugin actions over the network, modifying booking data on affected WordPress sites without any user interaction.

Affected Products

CodePeople WP Time Slots Booking Form plugin for WordPress
All versions from initial release through 1.2.06
WordPress sites where the vulnerable plugin is installed and activated

Discovery Timeline

2024-06-09 - CVE-2024-33543 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-33543

Vulnerability Analysis

The plugin exposes one or more action handlers that fail to verify the caller's authorization before performing privileged operations. This is a classic broken access control pattern in WordPress plugins, where capability checks (current_user_can()) or nonce validation (check_admin_referer(), wp_verify_nonce()) are absent or applied inconsistently.

Because the attack vector is network-based and requires no privileges or user interaction, any remote actor able to reach the WordPress site can invoke the affected endpoints. The impact is scoped to integrity, meaning attackers can alter booking state or related plugin data without disclosing sensitive information or taking the site offline.

The issue is tracked under CWE-862: Missing Authorization. No public proof-of-concept exploit, CISA KEV listing, or Exploit-DB entry exists at the time of writing.

Root Cause

The root cause is the absence of a server-side authorization check on one or more AJAX or admin-post action handlers registered by the plugin. WordPress action hooks such as wp_ajax_* and wp_ajax_nopriv_* must be gated with explicit capability and nonce verification. When these checks are missing, any HTTP request that supplies the expected action parameter is processed as if it originated from an authorized user.

Attack Vector

An attacker sends a crafted HTTP POST request to the WordPress site's admin-ajax.php endpoint or another exposed action handler registered by the plugin. The request includes the action name and parameters required to trigger the privileged operation. Because no authentication or capability check is performed, the plugin executes the action and modifies booking-related data.

No authenticated session, CSRF token, or user interaction is required. The attacker only needs network reachability to the target site. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-33543

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php referencing plugin-specific action values from unauthenticated sessions
Unexplained modifications, creations, or deletions of booking entries managed by WP Time Slots Booking Form
Repeated requests to plugin endpoints from a single IP address without a valid WordPress authentication cookie
Web server access logs showing direct access to plugin PHP files outside of normal user flows

Detection Strategies

Inventory all WordPress installations and identify those running WP Time Slots Booking Form version 1.2.06 or earlier
Enable WordPress audit logging to capture plugin action invocations and correlate them with authenticated user IDs
Review web application firewall (WAF) telemetry for anomalous POST volumes against admin-ajax.php referencing this plugin

Monitoring Recommendations

Forward WordPress, PHP, and web server logs to a centralized log platform for correlation and retention
Alert on unauthenticated requests that invoke plugin actions historically reserved for logged-in administrators
Monitor changes to booking database tables and configuration options written by the plugin

How to Mitigate CVE-2024-33543

Immediate Actions Required

Update WP Time Slots Booking Form to a version later than 1.2.06 as soon as the vendor publishes a fixed release
Audit existing booking records and plugin settings for unauthorized changes that may indicate prior exploitation
Restrict access to /wp-admin/ and admin-ajax.php from untrusted networks where business requirements allow

Patch Information

The vendor advisory tracked by Patchstack indicates the vulnerability affects versions up to and including 1.2.06. Site administrators should consult the Patchstack Vulnerability Report for the latest patched version and apply the update through the WordPress plugin manager.

Workarounds

Deactivate and remove the plugin if a patched release is not yet available and the booking feature is non-essential
Deploy a WAF rule that blocks unauthenticated requests to plugin-specific action parameters on admin-ajax.php
Limit administrative endpoints to known IP ranges using web server access control or a reverse proxy

bash

# Example: restrict admin-ajax.php to authenticated sessions via nginx
location = /wp-admin/admin-ajax.php {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}