CVE-2024-37505: Business One Page Auth Bypass Vulnerability

CVE-2024-37505 Overview

CVE-2024-37505 is a missing authorization vulnerability in the Rara Themes Business One Page WordPress theme. The flaw affects all versions up to and including 1.2.9. The theme fails to enforce proper access control on a notice dismissal function, allowing unauthorized users to trigger actions that should be restricted to privileged roles. The vulnerability is categorized under [CWE-862] Missing Authorization. Exploitation requires user interaction over the network, but no authentication or elevated privileges are needed.

Critical Impact

Attackers can exploit incorrectly configured access control on notice dismissal functionality in the Business One Page theme, resulting in limited confidentiality and integrity impact on affected WordPress sites.

Affected Products

• Rara Themes Business One Page WordPress theme
• All versions from n/a through 1.2.9
• WordPress installations using the vulnerable theme

Discovery Timeline

• 2024-11-01 - CVE-2024-37505 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37505

Vulnerability Analysis

The Business One Page WordPress theme contains a broken access control flaw in its administrative notice dismissal handler. The affected code path processes a dismissal request without validating whether the requester has the required capability or role. This omission allows attackers to trigger the dismissal action against a WordPress site where an administrator visits a crafted link or page.

The attack requires user interaction, meaning the target must be induced to click a link or load an attacker-controlled resource. The impact is limited to modifying the notice state and reading related information, without affecting availability. The vulnerability aligns with [CWE-862] Missing Authorization, where the application does not perform an authorization check when a subject attempts a privileged action.

The EPSS score of 0.308% places this vulnerability in a low-probability tier for near-term exploitation attempts.

Root Cause

The root cause is the absence of a capability check within the notice dismissal handler in the theme. WordPress themes must call current_user_can() and verify a valid nonce with check_ajax_referer() or wp_verify_nonce() before performing state-changing operations. The Business One Page theme omits these checks on the dismissal endpoint, allowing any request that reaches the handler to succeed regardless of the caller's role.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a request targeting the vulnerable dismissal endpoint and delivers it to a WordPress site user through phishing, malicious links, or embedded content. When the request is processed, the theme executes the dismissal action without verifying authorization. Refer to the Patchstack Vulnerability Report for full technical details of the vulnerable code path.

Detection Methods for CVE-2024-37505

Indicators of Compromise

• Unexpected HTTP requests to admin-ajax.php referencing the theme's dismissal action from unauthenticated sessions
• WordPress admin notices disappearing without administrator interaction
• Access log entries showing dismissal requests originating from external referrers or unusual user agents

Detection Strategies

• Audit web server access logs for requests targeting theme-specific AJAX actions without a valid authenticated admin session
• Deploy a web application firewall rule to flag POST requests to admin-ajax.php with the theme's dismissal action parameter from unauthenticated origins
• Compare installed theme versions against the fixed release advisory published on Patchstack

Monitoring Recommendations

• Enable WordPress activity logging to record all AJAX action invocations and the associated user context
• Monitor for HTTP referrers originating outside the WordPress admin dashboard on privileged endpoints
• Track theme and plugin inventory across managed WordPress sites to identify vulnerable installations of Business One Page <= 1.2.9

How to Mitigate CVE-2024-37505

Immediate Actions Required

• Identify all WordPress installations running the Business One Page theme at version 1.2.9 or earlier
• Update the theme to a patched release as identified by Rara Themes and Patchstack
• Restrict administrator access to trusted networks where feasible until patching is complete
• Educate administrators on avoiding untrusted links while authenticated to the WordPress dashboard

Patch Information

Refer to the Patchstack Vulnerability Report for the current fixed version guidance. Apply the vendor-supplied update through the WordPress admin theme updater or by replacing the theme files directly.

Workarounds

• Deploy a web application firewall rule blocking unauthenticated requests to the theme's dismissal AJAX action
• Temporarily switch to an alternative theme if patching cannot be completed promptly
• Restrict admin-ajax.php access using authentication-aware reverse proxy rules for high-risk deployments

# Example WAF rule (ModSecurity) blocking unauthenticated dismissal requests
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1004037505,\
  msg:'Block unauthenticated Business One Page notice dismissal'"
  SecRule ARGS:action "@rx business_one_page_.*dismiss" "chain"
  SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"