CVE-2024-34821: Contact List Authorization Bypass Vulnerability

CVE-2024-34821 Overview

CVE-2024-34821 is a Missing Authorization vulnerability [CWE-862] in the Anssi Laitila Contact List plugin for WordPress. The flaw affects all plugin versions up to and including 2.9.87. The issue is classified as a broken access control weakness in the contact-list plugin distributed by Contactlistpro. An unauthenticated remote attacker can reach plugin functionality that should require authorization checks. Successful exploitation leads to limited integrity impact on the target WordPress site without requiring user interaction.

Critical Impact

Unauthenticated network-based attackers can invoke plugin actions that lack proper authorization checks, resulting in limited integrity impact on affected WordPress installations.

Affected Products

• Contactlistpro Contact List plugin for WordPress, versions up to and including 2.9.87
• WordPress sites running the contact-list plugin by Anssi Laitila
• Any deployment sourcing the plugin from the WordPress plugin repository at or below 2.9.87

Discovery Timeline

• 2024-06-11 - CVE-2024-34821 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34821

Vulnerability Analysis

The vulnerability stems from missing authorization enforcement inside the Contact List WordPress plugin. Functionality exposed by the plugin does not validate whether the requester holds the required capability or role before executing sensitive actions. Attackers can send crafted HTTP requests to the plugin endpoints and trigger actions that should be restricted to authorized users. The impact is limited to integrity, allowing modification of plugin-managed data without corresponding disclosure or availability effects.

Because the flaw is network-reachable and requires no authentication or user interaction, mass scanning of exposed WordPress sites is trivial. The Patchstack advisory categorizes the issue as broken access control, which is consistent with the CWE-862 assignment.

Root Cause

The root cause is the absence of capability checks (for example, current_user_can()) and nonce validation on plugin actions that modify state. When AJAX handlers or admin-post endpoints omit these checks, the WordPress permission model is bypassed. Refer to the Patchstack Vulnerability Report for the technical breakdown.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker issues HTTP POST or GET requests to the vulnerable plugin endpoint without providing valid session credentials or a valid nonce. The absence of privilege checks causes the plugin to execute the requested action. See the Patchstack Detailed Analysis for additional context.

No verified proof-of-concept code is publicly available for this CVE.
Refer to the linked Patchstack advisories for technical details.

Detection Methods for CVE-2024-34821

Indicators of Compromise

• Unauthenticated HTTP requests to admin-ajax.php or admin-post.php referencing contact-list plugin actions
• Unexpected modifications to contact list entries or plugin settings in the WordPress database
• Access log entries showing plugin endpoint invocations from external IP addresses without prior authentication

Detection Strategies

• Inventory WordPress deployments and identify sites running Contact List <= 2.9.87
• Correlate web server access logs against unauthenticated requests targeting plugin AJAX or admin-post handlers
• Monitor WordPress audit logs for state changes originating from anonymous sessions

Monitoring Recommendations

• Enable a WordPress activity log plugin to record plugin option changes and content modifications
• Deploy a web application firewall (WAF) rule set that flags unauthenticated POST requests to plugin endpoints
• Alert on spikes in requests to /wp-admin/admin-ajax.php referencing the contact-list action parameter

How to Mitigate CVE-2024-34821

Immediate Actions Required

• Update the Contact List plugin to a version above 2.9.87 once the vendor publishes a fixed release
• Audit contact list data and plugin settings for unauthorized modifications
• Restrict access to /wp-admin/ and plugin endpoints using IP allowlisting where feasible

Patch Information

At the time of NVD publication, the advisory identifies affected versions up to and including 2.9.87 and does not specify a fixed release. Administrators should consult the Patchstack Vulnerability Report for the current patch status and upgrade guidance.

Workarounds

• Disable and remove the Contact List plugin until a patched version is confirmed available
• Deploy WAF rules that block unauthenticated requests to the plugin's AJAX and admin-post actions
• Enforce authentication proxies in front of /wp-admin/ to prevent anonymous access to plugin endpoints

# Example WAF rule concept: block unauthenticated requests to the vulnerable plugin action
# Replace <action_name> with the specific contact-list action identified in access logs
SecRule REQUEST_URI "@rx /wp-admin/admin-ajax\.php" \
  "chain,deny,status:403,id:1003482,msg:'Block unauth contact-list plugin action'"
  SecRule ARGS:action "@rx ^contact_list_" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"