CVE-2024-37496: Metro Magazine Auth Bypass Vulnerability

CVE-2024-37496 Overview

CVE-2024-37496 is a Missing Authorization vulnerability [CWE-862] in the Rara Themes Metro Magazine WordPress theme. The flaw stems from incorrectly configured access control on a notice dismissal function. Attackers can exploit the issue remotely over the network with low complexity and no prior authentication, though user interaction is required. The vulnerability affects all versions of Metro Magazine up to and including 1.3.7. Successful exploitation results in a limited integrity impact, allowing unauthorized actions tied to administrative notice handling within affected WordPress sites.

Critical Impact
Unauthenticated users can trigger functions that should require proper authorization, breaking the access control model of the Metro Magazine theme.

Affected Products

Rara Themes Metro Magazine WordPress theme
Versions from n/a through 1.3.7
WordPress sites running the vulnerable theme

Discovery Timeline

2026-06-17 - CVE-2024-37496 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37496

Vulnerability Analysis

The vulnerability resides in the notice dismissal handler of the Metro Magazine theme. The handler does not validate whether the requesting user has the appropriate role or capability before processing the request. As a result, a request reaches sensitive functionality without proper authorization checks.

This class of weakness aligns with [CWE-862: Missing Authorization]. The theme exposes an action endpoint reachable by any visitor, including unauthenticated ones. Although the affected feature is limited to administrative notice state, the absence of capability checks violates the WordPress security model.

According to the Patchstack advisory, the issue is described as broken access control on notice dismissal. Exploitation requires user interaction, which typically means an attacker must lure a target to a crafted link or page. The resulting integrity impact is limited, and no confidentiality or availability impact is reported.

Root Cause

The root cause is the absence of capability verification and nonce validation around the notice dismissal action. WordPress themes must use current_user_can() checks and check_ajax_referer() calls to enforce access control. Metro Magazine through version 1.3.7 omits these guards on the relevant handler.

Attack Vector

An attacker sends a crafted request to the vulnerable endpoint, typically through a link or page that triggers the action when a victim visits it. Because authentication is not required and complexity is low, the attacker only needs the victim to interact with the prepared payload. The action then executes without proper privilege validation.

No verified proof-of-concept code is publicly available. See the Patchstack WordPress Vulnerability entry for additional technical context.

Detection Methods for CVE-2024-37496

Indicators of Compromise

Unexpected HTTP POST or GET requests to admin-ajax.php with action parameters tied to Metro Magazine notice dismissal
Repeated requests to theme handlers from unauthenticated sessions or external referrers
Web server log entries showing dismissal actions outside of administrator browsing sessions

Detection Strategies

Inspect WordPress access logs for unauthenticated requests targeting Metro Magazine theme actions
Deploy a Web Application Firewall (WAF) rule that flags requests to theme-specific AJAX actions lacking valid _wpnonce parameters
Correlate browser referrers and session cookies against ajax action calls to identify cross-site triggered requests

Monitoring Recommendations

Enable verbose logging on WordPress AJAX endpoints and forward logs to a centralized SIEM
Monitor user-agent strings and request frequency against the affected endpoint
Alert on changes to WordPress option values written by the notice dismissal handler

How to Mitigate CVE-2024-37496

Immediate Actions Required

Identify all WordPress sites using the Rara Themes Metro Magazine theme and confirm version status
Update Metro Magazine to a version newer than 1.3.7 once the vendor publishes a fixed release
Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible
Apply virtual patching at the WAF layer until the official update is deployed

Patch Information

The Patchstack advisory documents the vulnerability through version 1.3.7. Site administrators should review the Patchstack WordPress Vulnerability entry and apply any vendor update issued after that version.

Workarounds

Disable the Metro Magazine theme and switch to an alternative theme until a patched release is available
Add server-side rules that block unauthenticated requests to the affected AJAX action
Enforce nonce validation through a custom mu-plugin that wraps the vulnerable handler

bash

# Example WAF rule pattern to block unauthenticated dismissal requests
# Adjust the action name based on theme source review
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1003749601,msg:'Block Metro Magazine notice dismissal abuse'"
    SecRule ARGS:action "@rx metro_magazine_.*dismiss" \
        "chain"
        SecRule &REQUEST_COOKIES:wordpress_logged_in_ "@eq 0"