CVE-2024-43131 Overview
CVE-2024-43131 is an incorrect authorization vulnerability in the WPWeb Docket plugin for WordPress, marketed as WooCommerce Collections / Wishlist / Watchlist. The flaw affects all versions before 1.7.0 and is categorized under [CWE-863]. An unauthenticated attacker can reach functionality that should be restricted by access control lists, enabling arbitrary deletion of posts and pages on affected sites. The issue is exploitable over the network without user interaction and without prior authentication, making any internet-facing WordPress site running a vulnerable Docket version reachable.
Critical Impact
Unauthenticated attackers can delete arbitrary WordPress posts and pages, causing integrity loss and site disruption on stores using the Docket plugin.
Affected Products
- WPWeb Docket (WooCommerce Collections / Wishlist / Watchlist) plugin for WordPress
- All versions prior to 1.7.0
- WordPress sites running WooCommerce with the Docket plugin enabled
Discovery Timeline
- 2024-08-13 - CVE-2024-43131 published to NVD
- 2026-01-28 - Last updated in NVD database
Technical Details for CVE-2024-43131
Vulnerability Analysis
The Docket plugin exposes functionality that performs sensitive state-changing operations, including post and page deletion, without enforcing proper authorization checks. According to the Patchstack Vulnerability Report, the affected handler does not verify the requesting user's capability or validate a nonce before processing destructive requests. This allows any unauthenticated visitor to invoke the deletion logic against arbitrary post or page identifiers managed by WordPress.
The vulnerability is classified as Broken Access Control [CWE-863]. The impact is concentrated on data integrity, since attackers can remove published content, product pages, and other post types. Confidentiality and availability of the underlying server are not directly affected, but loss of customer-facing pages on a WooCommerce store represents a meaningful business impact.
Root Cause
The root cause is missing capability and nonce verification in a plugin endpoint that should be limited to administrative users. The plugin trusts request parameters identifying the target object without confirming that the caller has authority over that object. This is a classic ACL enforcement failure rather than a flaw in WordPress core.
Attack Vector
The attack vector is remote and unauthenticated. An attacker sends a crafted HTTP request to the vulnerable plugin endpoint, supplying the identifier of a post or page to delete. Because no session, cookie, capability check, or nonce is required, the request can be issued directly from any HTTP client. Mass-scanning for vulnerable installations is straightforward given the plugin's fixed endpoint signature.
No verified public proof-of-concept code is referenced in the advisory. Refer to the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-43131
Indicators of Compromise
- Unexpected wp_posts entries transitioning to trash or being removed without an authenticated administrator action in the WordPress audit log.
- HTTP POST or GET requests to Docket plugin endpoints originating from unauthenticated sessions or unfamiliar IP addresses.
- Sudden disappearance of WooCommerce product pages, published posts, or static pages reported by site editors.
Detection Strategies
- Review web server access logs for requests targeting Docket plugin paths under /wp-content/plugins/ or related AJAX actions, especially without valid authentication cookies.
- Monitor the WordPress database for deletion events by enabling an audit logging plugin that records before_delete_post and deleted_post hooks.
- Correlate plugin version inventory across managed WordPress sites and flag any Docket installation below version 1.7.0.
Monitoring Recommendations
- Enable file integrity and content monitoring for the WordPress posts table and key published URLs.
- Forward web server and WordPress audit logs to a centralized logging or SIEM platform for retention and alerting on bulk deletion patterns.
- Alert on anomalous request rates to plugin endpoints from single source IPs, which often precede mass-exploitation activity.
How to Mitigate CVE-2024-43131
Immediate Actions Required
- Update the Docket (WooCommerce Collections / Wishlist / Watchlist) plugin to version 1.7.0 or later on every affected WordPress site.
- Audit recent post and page deletions and restore content from backups where unauthorized removals are identified.
- Restrict access to /wp-admin/admin-ajax.php and plugin endpoints using a web application firewall rule until patching is complete.
Patch Information
WPWeb addressed the issue in Docket version 1.7.0 by introducing proper authorization checks on the affected endpoint. Site operators should upgrade through the WordPress plugin updater or by replacing plugin files with the fixed release. Details of the fix are summarized in the Patchstack Vulnerability Report.
Workarounds
- Deactivate and remove the Docket plugin if an immediate upgrade to 1.7.0 is not feasible.
- Deploy WAF rules that block unauthenticated requests to the vulnerable Docket AJAX actions and require valid WordPress nonces.
- Maintain off-site backups of the WordPress database so that deleted posts and pages can be restored quickly if exploitation occurs.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
