CVE-2024-43118: Hummingbird Auth Bypass Vulnerability

CVE-2024-43118 Overview

CVE-2024-43118 is a Missing Authorization vulnerability [CWE-862] in the WPMU DEV Hummingbird performance optimization plugin for WordPress. The flaw affects Hummingbird versions up to and including 3.9.1. An authenticated attacker with low privileges can invoke plugin functionality that should be restricted to administrators. The issue stems from broken access control on privileged actions within the plugin. Exploitation requires network access and low-privileged credentials, with no user interaction needed.

Critical Impact
Authenticated low-privilege users can access administrator-level plugin functionality, potentially altering site configuration, cache behavior, and performance settings on WordPress installations running vulnerable Hummingbird versions.

Affected Products

WPMU DEV Hummingbird plugin for WordPress versions through 3.9.1
WordPress sites using hummingbird-performance with default configuration
Multisite WordPress deployments with Hummingbird installed network-wide

Discovery Timeline

2024-11-01 - CVE-2024-43118 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43118

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw classified under [CWE-862]. Hummingbird exposes plugin actions that do not verify the caller holds the required WordPress capability. Any authenticated user, including subscriber-level accounts on sites that permit registration, can reach these actions.

The attack vector is network-based with low complexity and requires only low-privileged credentials. No user interaction is required, and confidentiality, integrity, and availability are all affected. The impact scope is limited to the vulnerable WordPress instance.

Root Cause

The root cause is the absence of a current_user_can() capability check on one or more plugin handlers. WordPress plugins typically enforce authorization through capability checks combined with nonce verification. When those checks are missing or incomplete, plugin actions become reachable by any authenticated user regardless of role.

Attack Vector

An attacker authenticates to the WordPress site using any valid low-privileged account. The attacker then sends a crafted request to the affected Hummingbird endpoint, typically admin-ajax.php or a REST route. Because the handler does not enforce administrator capability, the requested action executes with the effective privileges of the plugin. Full technical details are available in the Patchstack Hummingbird Plugin Vulnerability advisory.

No verified public proof-of-concept code is available at this time. Refer to the vendor advisory for exploitation specifics.

Detection Methods for CVE-2024-43118

Indicators of Compromise

Unexpected changes to Hummingbird cache, minification, or asset optimization settings
POST requests to admin-ajax.php with Hummingbird-related action parameters originating from non-administrator sessions
New or modified entries in the WordPress options table associated with the wphb_ prefix
Log entries showing low-privileged user IDs invoking privileged plugin actions

Detection Strategies

Audit WordPress access logs for requests to Hummingbird AJAX and REST endpoints correlated with non-admin user cookies
Compare current plugin configuration against a known-good baseline using version control or database snapshots
Enable WordPress audit logging plugins to capture privileged actions by user role

Monitoring Recommendations

Alert on POST requests to wp-admin/admin-ajax.php containing action=wphb_ parameters from subscriber or contributor accounts
Monitor plugin option changes and unexpected cache flushes outside maintenance windows
Track authentication events from newly registered accounts followed by immediate plugin API calls

How to Mitigate CVE-2024-43118

Immediate Actions Required

Update the Hummingbird plugin to a version later than 3.9.1 through the WordPress plugin repository
Review all WordPress user accounts and remove unused or suspicious low-privileged users
Disable open user registration on sites that do not require it by unchecking Anyone can register under Settings > General

Patch Information

WPMU DEV addressed the broken access control issue in a release following version 3.9.1. Site administrators should upgrade to the latest available Hummingbird release. Consult the Patchstack Hummingbird Plugin Vulnerability advisory for the specific fixed version and patch details.

Workarounds

Deactivate the Hummingbird plugin until the update can be applied if patching is not immediately possible
Restrict access to wp-admin/admin-ajax.php at the web application firewall layer for non-administrator sessions where feasible
Enforce strong authentication and multi-factor authentication on all WordPress accounts to reduce the pool of usable low-privileged credentials

bash

# Update Hummingbird via WP-CLI
wp plugin update hummingbird-performance
wp plugin get hummingbird-performance --field=version