CVE-2024-35723 Overview
CVE-2024-35723 is a Missing Authorization vulnerability [CWE-862] in the Andrew Dashboard To-Do List WordPress plugin (dashboard-to-do-list). The flaw affects all versions up to and including 1.2.0. Authenticated attackers with low privileges can invoke plugin functions without proper capability checks. This broken access control weakness impacts confidentiality, integrity, and availability of WordPress sites running the plugin.
Critical Impact
Authenticated users with low privileges can bypass authorization controls to invoke restricted plugin functionality, compromising the integrity and availability of affected WordPress sites.
Affected Products
- Arwebdesign Dashboard To-Do List plugin for WordPress
- All versions from n/a through 1.2.0
- WordPress sites with the dashboard-to-do-list plugin installed and activated
Discovery Timeline
- 2024-06-10 - CVE-2024-35723 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-35723
Vulnerability Analysis
The Dashboard To-Do List plugin exposes actions that lack proper authorization checks. WordPress plugins are expected to verify user capabilities using functions such as current_user_can() before executing privileged operations. This plugin omits those checks on one or more endpoints, allowing users authenticated at low privilege levels to execute actions reserved for administrators.
The vulnerability falls under the Broken Access Control category tracked by Patchstack. Because the plugin runs inside the WordPress admin context, successful exploitation can affect stored to-do data, plugin state, and any resources reachable through the exposed handlers.
Root Cause
The root cause is missing authorization logic in plugin action handlers. The plugin registers endpoints or AJAX actions that neither validate the caller's role nor enforce capability requirements. As a result, the server processes requests from any authenticated session regardless of privilege level, violating the principle of least privilege.
Attack Vector
Exploitation requires network access to the WordPress site and a valid low-privilege account, such as subscriber or contributor. The attacker sends HTTP requests to the unprotected plugin endpoints, triggering functionality that should be gated behind administrator capabilities. No user interaction is required beyond the attacker's own authenticated session.
No public proof-of-concept exploit code has been published for CVE-2024-35723. Technical details are described in the Patchstack Vulnerability Advisory.
Detection Methods for CVE-2024-35723
Indicators of Compromise
- Unexpected modifications to to-do list entries created or altered by non-administrator accounts.
- HTTP POST requests to admin-ajax.php or plugin-specific endpoints originating from subscriber or contributor sessions.
- New or elevated WordPress accounts appearing shortly after suspicious plugin-related requests.
Detection Strategies
- Audit WordPress access logs for requests to dashboard-to-do-list handlers from low-privilege users.
- Inspect the plugin source in wp-content/plugins/dashboard-to-do-list/ for action hooks missing current_user_can() checks.
- Use a web application firewall (WAF) with WordPress-aware rules to flag privilege mismatches on plugin endpoints.
Monitoring Recommendations
- Enable WordPress audit logging to record capability checks and administrative actions.
- Alert on plugin file changes and unexpected AJAX action invocations by non-admin roles.
- Forward web server and WordPress logs to a centralized analytics platform for correlation and long-term retention.
How to Mitigate CVE-2024-35723
Immediate Actions Required
- Update the Dashboard To-Do List plugin to a version later than 1.2.0 once a patched release is available from the vendor.
- Deactivate and remove the plugin if no patched version is available and the functionality is not essential.
- Review WordPress user accounts and revoke any unnecessary low-privilege registrations that could be abused for exploitation.
Patch Information
No vendor patch is referenced in the CVE record beyond the advisories published by Patchstack. Site owners should consult the Patchstack Vulnerability Details page for the current fix status and upgrade instructions.
Workarounds
- Restrict access to wp-admin/admin-ajax.php from untrusted networks using a WAF or reverse proxy rules.
- Disable open user registration on the WordPress site to limit the population of accounts that could exploit the flaw.
- Apply virtual patching rules from a managed WordPress security service until an official plugin update is installed.
# Configuration example: disable open registration and remove the vulnerable plugin
wp option update users_can_register 0
wp plugin deactivate dashboard-to-do-list
wp plugin delete dashboard-to-do-list
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
