CVE-2024-43256: Leopard WordPress Plugin Auth Bypass Flaw

CVE-2024-43256 Overview

CVE-2024-43256 is a missing authorization vulnerability [CWE-862] in the nouthemes Leopard - WordPress Offload Media plugin. The flaw affects all plugin versions up to and including 2.0.36. Authenticated users with low privileges, such as Subscribers, can access plugin functionality that should be restricted by access control lists (ACLs). Successful exploitation enables attackers to modify plugin settings and disrupt media offload behavior across the WordPress site.

Critical Impact
Any authenticated WordPress user, including Subscriber-level accounts, can alter Leopard plugin settings and impact site availability due to broken access control.

Affected Products

nouthemes Leopard - WordPress Offload Media plugin
All versions from n/a through 2.0.36
WordPress sites with the plugin activated and open user registration

Discovery Timeline

2024-08-19 - CVE-2024-43256 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43256

Vulnerability Analysis

The Leopard - WordPress Offload Media plugin exposes administrative functionality without validating the caller's role or capability. Endpoints that update plugin settings check that a request is authenticated but do not verify that the requester holds manage_options or an equivalent capability. As a result, any logged-in user, including Subscribers created through WordPress open registration, can invoke settings-modification handlers. The vulnerability is classified as Missing Authorization [CWE-862].

An attacker who changes offload media configuration can point storage destinations to attacker-controlled infrastructure, disable offloading, or corrupt existing media delivery. The confidentiality impact is limited, but the integrity of plugin configuration and availability of media assets are directly affected.

Root Cause

The plugin's request handlers rely on nonce or authentication checks in place of capability checks. WordPress requires developers to call functions such as current_user_can('manage_options') before executing privileged actions. The Leopard plugin omits this check, treating any authenticated session as authorized to change plugin settings.

Attack Vector

The attack is network-based and requires low privileges with no user interaction. An attacker registers or reuses a Subscriber account, obtains a valid nonce from an accessible page, and submits a crafted request to the plugin's settings endpoint. The server accepts the request and applies the attacker-supplied configuration. Refer to the Patchstack Vulnerability Report for endpoint-level technical details.

Detection Methods for CVE-2024-43256

Indicators of Compromise

Unexpected modifications to Leopard plugin settings in the wp_options table, particularly entries prefixed with the plugin's option name.
Media offload targets pointing to unfamiliar S3 buckets, endpoints, or storage providers.
POST requests to plugin AJAX or admin-post handlers originating from low-privilege user sessions.
Newly created Subscriber accounts followed shortly by administrative-style POST traffic.

Detection Strategies

Monitor WordPress audit logs for settings changes performed by non-administrator accounts.
Alert on HTTP POST requests to Leopard plugin endpoints where the authenticated user role is Subscriber or Contributor.
Compare current plugin option values against a known-good baseline to detect unauthorized changes.

Monitoring Recommendations

Enable WordPress activity logging with a plugin that records role, IP address, and modified option keys.
Forward web server access logs to a centralized log platform and query for repeated POST activity from newly registered accounts.
Track plugin version inventory across WordPress deployments to identify hosts still running 2.0.36 or earlier.

How to Mitigate CVE-2024-43256

Immediate Actions Required

Update the Leopard - WordPress Offload Media plugin to a version released after 2.0.36 once the vendor publishes a fix.
Audit existing WordPress user accounts and remove or disable unused Subscriber accounts.
Disable open user registration on sites that do not require it by unchecking Anyone can register in Settings > General.

Patch Information

At the time of the NVD entry, the vulnerability is reported against all versions through 2.0.36. Administrators should consult the Patchstack Vulnerability Report and the WordPress plugin repository for the latest fixed release.

Workarounds

Deactivate and remove the Leopard plugin until a patched version is available and validated.
Restrict access to wp-admin/admin-ajax.php and wp-admin/admin-post.php using a web application firewall rule that blocks Leopard-specific actions for non-administrator users.
Enforce role-based access at the reverse proxy by denying POST requests to plugin endpoints from sessions that do not carry an administrator cookie.

bash

# Example WAF rule (ModSecurity) to block Leopard settings changes from non-admin sessions
SecRule REQUEST_URI "@rx /wp-admin/admin-(ajax|post)\.php" \
  "chain,phase:2,deny,status:403,id:1004325601,msg:'Block Leopard plugin settings change attempt'"
SecRule ARGS:action "@rx ^leopard_" \
  "chain"
SecRule REQUEST_COOKIES:/wordpress_logged_in_/ "@rx ." \
  "chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_admin_/ "@eq 0"