CVE-2024-38742: MBE eShip Information Disclosure Flaw

CVE-2024-38742 Overview

CVE-2024-38742 is a sensitive information disclosure vulnerability in the MBE eShip WordPress plugin by MBE Worldwide S.P.A. The flaw allows unauthenticated attackers to access functionality that is not properly constrained by Access Control Lists (ACLs). It affects all versions of MBE eShip up to and including 2.1.2. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Remote attackers can retrieve confidential data from vulnerable installations without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can access restricted plugin functionality and retrieve sensitive shipping and configuration data from affected WordPress sites running MBE eShip 2.1.2 or earlier.

Affected Products

MBE Worldwide S.P.A. MBE eShip plugin for WordPress
All versions from initial release through 2.1.2
WordPress sites using the Mail Boxes Etc. shipping integration

Discovery Timeline

2024-08-13 - CVE-2024-38742 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38742

Vulnerability Analysis

The MBE eShip plugin exposes plugin functionality without enforcing proper authorization checks. Attackers can invoke plugin endpoints that should be restricted to authenticated administrators or specific user roles. The result is disclosure of information intended to remain confidential, such as shipping configuration, API integration details, or order-related metadata.

The vulnerability requires no privileges and no user interaction. It is reachable over the network against any WordPress installation running a vulnerable version of the plugin. Because the flaw stems from missing ACL enforcement rather than input handling, exploitation typically involves direct HTTP requests to the exposed plugin routes.

The EPSS probability is 0.364% at the 29.357 percentile, indicating limited observed exploitation activity to date.

Root Cause

The root cause is broken access control within the MBE eShip plugin. Plugin actions and AJAX handlers lack capability checks or nonce validation to confirm the requesting user has permission to invoke them. This maps directly to CWE-200, where sensitive information is exposed to actors who should not have access.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends crafted HTTP requests to WordPress endpoints exposed by the plugin, such as admin-ajax.php actions or REST routes registered by MBE eShip. Because the plugin does not verify caller authorization, the server returns sensitive data in the HTTP response. Specific endpoint details are documented in the Patchstack Vulnerability Advisory.

No public proof-of-concept exploit is currently listed for this CVE. The vulnerability is not tracked in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-38742

Indicators of Compromise

Unexpected HTTP GET or POST requests to wp-admin/admin-ajax.php referencing MBE eShip actions from unauthenticated sessions
Anomalous access patterns targeting /wp-json/ REST routes registered by the mbe-eship plugin
Outbound data volumes from WordPress hosts that exceed baseline for the plugin's normal usage

Detection Strategies

Inventory WordPress installations to identify sites running MBE eShip and compare installed versions against 2.1.2
Review web server access logs for requests to MBE eShip endpoints originating from IPs without valid authentication cookies
Deploy web application firewall (WAF) rules that flag unauthenticated access to shipping plugin AJAX actions

Monitoring Recommendations

Enable verbose access logging on WordPress front-end and admin-ajax endpoints for at least 90 days
Correlate WordPress plugin activity with authentication events in a centralized logging platform
Alert on repeated requests to a single plugin action from the same source IP within short intervals

How to Mitigate CVE-2024-38742

Immediate Actions Required

Identify all WordPress sites running MBE eShip and confirm the installed plugin version
Update MBE eShip to a version later than 2.1.2 as soon as the vendor releases a fix
If no patched version is available, disable and remove the plugin until a fix is published
Rotate any API keys, shipping carrier credentials, or third-party tokens configured in the plugin

Patch Information

Refer to the Patchstack Vulnerability Advisory for current patch availability and remediation guidance from MBE Worldwide. Apply the fixed release through the WordPress plugin update mechanism once available.

Workarounds

Block external access to MBE eShip AJAX and REST endpoints at the WAF or reverse proxy layer
Restrict access to the WordPress site by IP allowlist while a patch is pending
Remove the plugin from production sites that do not actively require shipping label generation

bash

# Example: block unauthenticated access to MBE eShip AJAX actions at the web server
# nginx snippet — adjust action names to those documented in the advisory
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^mbe_eship_") {
        return 403;
    }
}