CVE-2024-35717 Overview
CVE-2024-35717 is a Missing Authorization vulnerability [CWE-862] in the A WP Life Media Slider WordPress plugin. The flaw affects Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow from unspecified early versions through 1.3.9. Authenticated attackers with low privileges can invoke plugin functions that lack proper access control checks. The vulnerability is exploitable over the network with low attack complexity and no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the WordPress site.
Critical Impact
Low-privileged users can bypass authorization controls in the Media Slider plugin to modify plugin data and site content, undermining the security posture of affected WordPress installations.
Affected Products
- A WP Life Media Slider WordPress plugin (all versions through 1.3.9)
- WordPress sites running the awplife/media_slider component
- Any site that has installed and activated the plugin prior to a patched release
Discovery Timeline
- 2024-06-10 - CVE-2024-35717 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-35717
Vulnerability Analysis
The vulnerability stems from missing authorization checks in the Media Slider plugin. Plugin endpoints do not verify whether an authenticated user has the required capability before executing privileged actions. As a result, low-privileged accounts such as subscribers or contributors can invoke functionality reserved for administrators. This class of flaw is tracked under CWE-862: Missing Authorization.
Exploitation requires only a valid authenticated session on the target WordPress site. Once authenticated, the attacker sends crafted HTTP requests to plugin endpoints, which execute without capability validation. According to the Patchstack Security Advisory, the flaw is categorized as broken access control affecting slider content, media references, and plugin configuration.
Root Cause
The plugin's action handlers omit current_user_can() capability checks and lack nonce validation on state-changing operations. Without these checks, WordPress does not enforce role-based restrictions on the vulnerable endpoints. Any authenticated request reaches the handler and executes as if the caller were authorized.
Attack Vector
An attacker registers or compromises a low-privileged account on the target site. The attacker then issues HTTP requests to the plugin's AJAX or admin-post handlers with parameters that alter slider entries, upload references, or plugin settings. The absence of authorization enforcement allows the requests to succeed, granting the attacker control over plugin-managed content on the site.
No verified exploit code is publicly available. Technical details are documented in the Patchstack Security Advisory.
Detection Methods for CVE-2024-35717
Indicators of Compromise
- Unexpected modifications to slider entries, media items, or plugin settings performed by non-administrator accounts
- POST requests from subscriber or contributor accounts to admin-ajax.php referencing Media Slider actions
- New or altered slider records in the database without corresponding administrator audit log entries
Detection Strategies
- Enable WordPress activity logging to capture user actions against plugin endpoints and correlate with account role
- Monitor web server access logs for authenticated requests to Media Slider endpoints originating from low-privileged sessions
- Compare installed plugin version against 1.3.9 and flag any site running an affected release
Monitoring Recommendations
- Alert when non-administrator accounts issue requests to plugin admin actions or AJAX handlers
- Track creation of new low-privileged accounts followed by requests to plugin endpoints within a short interval
- Baseline normal Media Slider administrative activity and alert on deviations in request source or frequency
How to Mitigate CVE-2024-35717
Immediate Actions Required
- Update the A WP Life Media Slider plugin to a version later than 1.3.9 as soon as a patched release is available from the vendor
- Audit user roles and remove untrusted low-privileged accounts on affected WordPress sites
- Review slider content and plugin settings for unauthorized modifications introduced before patching
Patch Information
The vulnerability affects Media Slider versions up to and including 1.3.9. Site administrators should consult the Patchstack Security Advisory for the current patched version and upgrade guidance. Confirm the upgrade path through the WordPress plugin repository before deployment.
Workarounds
- Deactivate and uninstall the Media Slider plugin until a fixed version is installed if the plugin is not business-critical
- Restrict access to /wp-admin/admin-ajax.php for non-administrator accounts using a web application firewall rule targeting Media Slider action parameters
- Disable user registration or set the default new-user role to a level that cannot authenticate to the vulnerable endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
