CVE-2024-35716 Overview
CVE-2024-35716 is a Missing Authorization vulnerability [CWE-862] in the Copymatic – AI Content Writer & Generator plugin for WordPress. The flaw affects all plugin versions up to and including 1.9. Authenticated attackers with low-level privileges can invoke plugin functionality that lacks proper capability checks. Successful exploitation results in high impact to confidentiality, integrity, and availability of the affected WordPress site.
Critical Impact
Authenticated users with minimal privileges can bypass access controls in the Copymatic plugin and perform actions restricted to higher-privileged roles, leading to full compromise of the plugin's data and site content.
Affected Products
- Copymatic – AI Content Writer & Generator plugin for WordPress
- All versions from n/a through 1.9
- WordPress sites with the Copymatic plugin installed and activated
Discovery Timeline
- 2024-06-11 - CVE-2024-35716 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-35716
Vulnerability Analysis
The vulnerability is a Broken Access Control issue in the Copymatic WordPress plugin. Plugin endpoints do not verify that the requesting user holds the required capability before executing privileged operations. An authenticated attacker with a low-privilege role such as Subscriber can send crafted HTTP requests to these endpoints. The plugin processes those requests as if the caller were authorized, allowing unauthorized read and write operations against plugin-managed resources.
Because the flaw is reachable over the network with low attack complexity and requires only low privileges, it presents a broad attack surface on any WordPress installation exposing user registration or containing existing low-privilege accounts. Exploitation does not require user interaction.
Root Cause
The root cause is the absence of authorization checks on plugin actions, categorized under CWE-862: Missing Authorization. The plugin fails to call WordPress capability functions such as current_user_can() or verify nonces via check_ajax_referer() before performing state-changing operations. Any authenticated session is therefore treated as authorized to execute the affected handlers.
Attack Vector
The attack vector is network-based and requires an authenticated account on the target WordPress site. An attacker registers or obtains a low-privileged account, then issues HTTP POST requests to the vulnerable plugin AJAX or admin-post endpoints. Because no capability check gates execution, the plugin performs the action with the attacker's request parameters. This can be used to modify plugin configuration, inject content generated through the AI service, or otherwise abuse plugin functionality reserved for administrators. Refer to the Patchstack Security Advisory for endpoint-level technical details.
Detection Methods for CVE-2024-35716
Indicators of Compromise
- Unexpected posts, pages, or drafts generated by the Copymatic plugin without administrator initiation
- HTTP POST requests to Copymatic plugin endpoints (for example, admin-ajax.php actions tied to the copymatic handler) originating from Subscriber-level accounts
- New or modified plugin option entries in the wp_options table referencing Copymatic settings
- Outbound API calls to the Copymatic AI service triggered outside normal administrator workflow
Detection Strategies
- Review WordPress access logs for requests to Copymatic endpoints paired with low-privilege session cookies
- Correlate plugin activity with the requesting user's role using WordPress audit logging plugins
- Alert on privilege-role mismatches where non-admin users trigger administrative plugin actions
Monitoring Recommendations
- Enable a WordPress activity log to track plugin actions, option changes, and content creation per user
- Monitor Web Application Firewall (WAF) logs for anomalous request patterns to the Copymatic plugin path
- Track new user registrations followed by immediate calls to plugin AJAX handlers as a high-fidelity signal
How to Mitigate CVE-2024-35716
Immediate Actions Required
- Deactivate the Copymatic – AI Content Writer & Generator plugin until a patched version is confirmed available
- Audit all WordPress user accounts and remove any unrecognized low-privilege users
- Disable open user registration (Anyone can register) under WordPress Settings > General if not required
- Review site content and plugin configuration for unauthorized modifications
Patch Information
At the time of publication, the vulnerability affects Copymatic versions through 1.9 with no fixed version listed in the advisory. Site administrators should consult the Patchstack Security Advisory for the latest remediation guidance and monitor the WordPress plugin repository for an updated release.
Workarounds
- Remove the Copymatic plugin entirely if a patched release is not available
- Restrict access to /wp-admin/admin-ajax.php for unauthenticated and low-privilege users at the WAF layer where feasible
- Enforce strong role-based access control and limit account creation to trusted users only
- Deploy a virtual patching rule via a WordPress security plugin or WAF to block requests to vulnerable Copymatic action handlers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
