CVE-2024-3610: WP Child Theme Generator Auth Bypass Flaw

CVE-2024-3610 Overview

The WP Child Theme Generator plugin for WordPress contains a missing authorization vulnerability in the wctg_easy_child_theme() function. All versions up to and including 1.1.1 are affected. The plugin fails to perform a capability check before allowing child theme creation and activation. Unauthenticated attackers can send requests that create a blank child theme and activate it, causing the target site to render a white screen. The issue is tracked as [CWE-862] Missing Authorization and impacts availability of affected WordPress installations. The vendor released version 1.1.2 to remediate the flaw.

Critical Impact

Unauthenticated remote attackers can force affected WordPress sites into a white-screen state by creating and activating a blank child theme, disrupting site availability.

Affected Products

• Wensolutions WP Child Theme Generator plugin for WordPress, versions 1.1.1 and prior
• WordPress installations with the plugin active and network-accessible
• Sites that have not upgraded to plugin version 1.1.2

Discovery Timeline

• 2024-06-21 - CVE-2024-3610 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-3610

Vulnerability Analysis

The vulnerability resides in the wctg_easy_child_theme() function inside wp-easy-child/wp-easy-child.php. This function is registered as an AJAX handler but lacks a capability check such as current_user_can() and does not enforce nonce validation for privileged operations. As a result, any request reaching the endpoint can trigger child theme generation and activation. The impact is limited to availability: successful exploitation renders the site inoperable through a WordPress white screen of death rather than disclosing data or executing code. See the WordPress Child Theme Code reference for the vulnerable source line.

Root Cause

The root cause is a missing authorization control [CWE-862]. The handler executes theme creation and activation logic without verifying that the requester holds the switch_themes or manage_options capability. Nonce validation is also absent, so requests from unauthenticated clients are accepted and processed.

Attack Vector

Exploitation is performed over the network by sending an HTTP request to the WordPress AJAX endpoint that dispatches to the vulnerable function. No authentication, no user interaction, and no elevated privileges are required. The attacker triggers the handler, which writes a blank child theme to the themes directory and switches the active theme, producing a white screen for all visitors and administrators.

No public proof-of-concept exploit code is available. Refer to the Wordfence Vulnerability Overview for additional advisory context.

Detection Methods for CVE-2024-3610

Indicators of Compromise

• Presence of an unexpected child theme directory under wp-content/themes/ containing minimal or empty files such as style.css and functions.php.
• Unexpected changes to the active theme recorded in the WordPress options table (template and stylesheet values).
• HTTP POST requests to admin-ajax.php invoking the wctg_easy_child_theme action from unauthenticated sources.
• Sudden site-wide white screen following a request to the plugin AJAX handler.

Detection Strategies

• Monitor web server access logs for requests to admin-ajax.php that reference the wctg_easy_child_theme action parameter, especially from IPs without prior authenticated sessions.
• Alert on file creation events in wp-content/themes/ that occur outside of change windows or without correlated administrator login activity.
• Compare the installed plugin version against 1.1.2 to identify vulnerable hosts across the estate.

Monitoring Recommendations

• Enable file integrity monitoring on the WordPress themes and plugins directories.
• Forward WordPress and web server logs to a centralized log platform for correlation and retention.
• Track HTTP 200 responses to the vulnerable AJAX action as high-signal telemetry for follow-up investigation.

How to Mitigate CVE-2024-3610

Immediate Actions Required

• Upgrade the WP Child Theme Generator plugin to version 1.1.2 or later on all WordPress instances.
• Audit wp-content/themes/ for unexpected child theme directories and remove them after confirming they are unauthorized.
• Restore the intended active theme through the WordPress admin or by updating the template and stylesheet options in the database if the site is white-screened.
• Review web server logs for prior requests to the vulnerable AJAX action and investigate any matches.

Patch Information

The vendor addressed the issue in plugin version 1.1.2. Review the code changes in the WordPress Plugin Changeset 1.1.2 to validate the fix. Apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

• If patching cannot be performed immediately, deactivate and remove the WP Child Theme Generator plugin.
• Block unauthenticated POST requests to admin-ajax.php targeting the wctg_easy_child_theme action at the web application firewall.
• Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible.

# Configuration example: upgrade the plugin using WP-CLI
wp plugin update wp-child-theme-generator --version=1.1.2
wp plugin list --name=wp-child-theme-generator --fields=name,status,version