CVE-2024-3895 Overview
The WP Datepicker plugin for WordPress contains a missing authorization vulnerability in the wpdp_add_new_datepicker_ajax() function. All versions up to and including 2.1.0 are affected. The flaw allows authenticated attackers with subscriber-level access or higher to update arbitrary WordPress options. Attackers can leverage this behavior to escalate privileges within the affected WordPress site. The issue is tracked as [CWE-862] Missing Authorization. It was partially patched in versions 2.0.9 and 2.1.0, and fully remediated in version 2.1.1.
Critical Impact
Authenticated subscribers can modify arbitrary WordPress options, enabling account takeover and full site compromise.
Affected Products
- Androidbubbles WP Datepicker plugin versions up to and including 2.1.0
- WP Datepicker 2.0.9 and 2.1.0 (partially patched, still vulnerable)
- WordPress sites running the vulnerable plugin
Discovery Timeline
- 2024-05-02 - CVE-2024-3895 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-3895
Vulnerability Analysis
The WP Datepicker plugin exposes an AJAX endpoint backed by the wpdp_add_new_datepicker_ajax() function. This function processes requests to create new datepicker configurations. The endpoint lacks a capability check to confirm the caller holds administrative privileges. Any authenticated user with a valid nonce and subscriber-level access can invoke it. The function writes user-supplied data directly to WordPress option storage using functions such as update_option().
An attacker abuses this behavior to overwrite security-critical options. Common privilege escalation targets include default_role, which controls the role assigned to new registrations, and users_can_register, which enables open registration. Modifying these values allows an attacker to register a new administrator account. The impact extends across confidentiality, integrity, and availability of the WordPress instance.
Root Cause
The root cause is a missing capability check inside the AJAX handler. WordPress AJAX callbacks registered under wp_ajax_ are reachable by any authenticated user. Developers must explicitly invoke current_user_can() to gate privileged actions. The vulnerable function omitted this check and trusted the caller to have appropriate rights.
Attack Vector
An attacker first authenticates to the target WordPress site using any low-privilege account, such as a subscriber. The attacker then issues a crafted POST request to /wp-admin/admin-ajax.php targeting the wpdp_add_new_datepicker action. The payload sets option names and values that grant administrative role assignment or enable registration. Follow-up requests register a privileged user, leading to complete site takeover. Public proof-of-concept code is not currently available, and the EPSS score reflects a moderate exploitation probability.
Detection Methods for CVE-2024-3895
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php with the action=wpdp_add_new_datepicker parameter originating from non-administrative accounts
- Recent changes to sensitive WordPress options such as default_role, users_can_register, siteurl, or home in the wp_options table
- Creation of new administrator accounts not initiated by known administrators
- Presence of WP Datepicker plugin versions 2.1.0 or earlier on WordPress installations
Detection Strategies
- Audit the WordPress wp_options table for unauthorized modifications by comparing current values against known-good baselines
- Enable and review WordPress audit logs for option changes correlated with subscriber-level user sessions
- Deploy web application firewall rules that inspect admin-ajax.php requests targeting the wpdp_add_new_datepicker action and enforce capability-based access
Monitoring Recommendations
- Continuously monitor for creation of new WordPress user accounts with the administrator role and correlate with source IP and session context
- Alert on toggling of users_can_register from 0 to 1 and any change to default_role
- Track plugin inventory and versions across WordPress fleets to identify unpatched WP Datepicker installations
How to Mitigate CVE-2024-3895
Immediate Actions Required
- Update the WP Datepicker plugin to version 2.1.1 or later on all WordPress sites
- Audit all WordPress user accounts and remove any unauthorized administrator accounts created during the exposure window
- Review and reset the default_role and users_can_register options to their intended secure values
- Rotate credentials and secrets for any account that may have been compromised during the exposure window
Patch Information
The vendor released a full fix in WP Datepicker version 2.1.1. Versions 2.0.9 and 2.1.0 contain a partial patch and remain exploitable. See the WordPress Plugin Changeset for the code-level fix and the Wordfence Vulnerability Report for additional analysis.
Workarounds
- Deactivate and remove the WP Datepicker plugin until version 2.1.1 can be deployed
- Restrict access to /wp-admin/admin-ajax.php from untrusted sources via web application firewall rules where feasible
- Disable open registration by setting users_can_register to 0 to limit the pool of authenticated attackers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
