CVE-2024-35662 Overview
CVE-2024-35662 is a Missing Authorization vulnerability [CWE-862] in the Andreas Sofantzis Simple COD Fees for WooCommerce plugin for WordPress. The flaw affects all versions from n/a through 2.0.2. The plugin fails to enforce proper authorization checks on privileged actions, enabling authenticated attackers with low privileges to access functions that should be restricted. Successful exploitation impacts confidentiality, integrity, and availability of the affected WooCommerce store.
Critical Impact
Authenticated attackers with low-privilege accounts can invoke restricted plugin functionality due to broken access control, potentially altering checkout logic, fee configuration, and store data on any WordPress site running Simple COD Fees for WooCommerce 2.0.2 or earlier.
Affected Products
- Andreas Sofantzis Simple COD Fees for WooCommerce (all versions through 2.0.2)
- WordPress installations running the vulnerable plugin
- WooCommerce stores dependent on the plugin for cash-on-delivery fee logic
Discovery Timeline
- 2024-06-09 - CVE-2024-35662 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-35662
Vulnerability Analysis
The vulnerability stems from missing authorization checks in the Simple COD Fees for WooCommerce plugin. The plugin exposes functionality that should be limited to administrators without validating the caller's role or capability. An authenticated user with subscriber or customer-level access can invoke these endpoints and perform actions outside their intended privilege boundary.
Broken access control in WordPress plugins commonly occurs when admin-ajax.php handlers or REST routes omit current_user_can() capability checks or nonce verification. In this case, the plugin's action handlers permit privileged operations to run without confirming the requester holds the required capability.
The issue is classified under CWE-862: Missing Authorization. The attack requires network access and valid low-privilege credentials, with no user interaction needed.
Root Cause
The plugin's request handlers do not enforce role or capability validation before executing sensitive operations. Authorization logic is either absent or relies on assumptions that any authenticated session is trusted, violating the principle of least privilege.
Attack Vector
An attacker first obtains a low-privilege account on the target WordPress site, which is common on WooCommerce stores that allow customer registration. The attacker then sends crafted HTTP requests to the plugin's action endpoints, invoking privileged functions such as modifying plugin configuration or manipulating checkout fee data. See the Patchstack Vulnerability Advisory for advisory details. No verified public proof-of-concept code is available.
Detection Methods for CVE-2024-35662
Indicators of Compromise
- Unexpected changes to Simple COD Fees plugin settings or fee values in the WooCommerce admin interface
- POST requests to admin-ajax.php or plugin REST endpoints originating from low-privilege user sessions
- New or modified WordPress options rows tied to the simple-cod-fees-for-woocommerce plugin without a corresponding administrator action
Detection Strategies
- Audit WordPress access logs for HTTP requests targeting the plugin's AJAX or REST endpoints paired with non-admin session cookies
- Compare current plugin option values against a known-good baseline to identify unauthorized configuration drift
- Enable WordPress activity logging plugins to record option changes, user role changes, and plugin setting modifications
Monitoring Recommendations
- Alert on repeated admin-ajax.php requests from a single subscriber or customer account within short time windows
- Monitor for new registrations followed by immediate requests to plugin-specific endpoints
- Track HTTP 200 responses to authenticated privileged actions initiated by accounts lacking administrator or shop-manager roles
How to Mitigate CVE-2024-35662
Immediate Actions Required
- Update Simple COD Fees for WooCommerce to a version later than 2.0.2 if the vendor has published a fix; consult the Patchstack advisory for current patch status
- Disable the plugin if no patched version is available and cash-on-delivery fees can be handled through native WooCommerce settings
- Review WordPress user accounts and remove untrusted low-privilege registrations
Patch Information
The vulnerability affects all versions of Simple COD Fees for WooCommerce through 2.0.2. Site owners should consult the Patchstack advisory for the latest remediation status and upgrade guidance.
Workarounds
- Restrict access to wp-admin/admin-ajax.php from unauthenticated or low-privilege sessions using a web application firewall rule
- Disable open user registration in WordPress settings if not required for store operations
- Deploy a virtual patching rule via a WAF to block requests to the vulnerable plugin's action handlers from non-administrator sessions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
