CVE-2024-43293: WPZOOM Recipe Card Auth Bypass Flaw

CVE-2024-43293 Overview

CVE-2024-43293 is a missing authorization vulnerability in the WPZOOM Recipe Card Blocks for Gutenberg & Elementor WordPress plugin. The flaw affects all versions up to and including 3.3.1. The plugin fails to enforce proper access control checks on protected functionality, allowing authenticated attackers with low privileges to perform actions restricted to higher-privileged roles. The weakness is classified as [CWE-862] Missing Authorization. Successful exploitation impacts confidentiality, integrity, and availability of the WordPress site.

Critical Impact
Authenticated attackers with low privileges can bypass access control restrictions to invoke administrative plugin functions, potentially compromising site content, configuration, and stored data.

Affected Products

WPZOOM Recipe Card Blocks for Gutenberg & Elementor versions through 3.3.1
WordPress installations running the vulnerable plugin
Sites permitting subscriber or contributor account registration

Discovery Timeline

2024-11-01 - CVE-2024-43293 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43293

Vulnerability Analysis

The vulnerability stems from incorrectly configured access control on plugin endpoints. The Recipe Card Blocks plugin exposes AJAX or REST actions that should be restricted to administrators or editors. These handlers do not verify the caller's capability before executing sensitive operations. An authenticated user with a low-privilege role can invoke these actions directly. The attack requires network access and low privileges, with no user interaction needed to trigger the flaw.

Root Cause

The root cause is the absence of capability checks such as current_user_can() on protected plugin handlers. The plugin relies on the WordPress authentication layer without enforcing role-based authorization. This design gap allows any logged-in user to access functions intended for privileged roles. [CWE-862] describes this exact pattern of missing authorization.

Attack Vector

An attacker first obtains a valid WordPress account, which can be achieved on sites with open registration or through credential compromise. The attacker then sends crafted HTTP requests to the plugin's exposed endpoints. Because the handlers lack authorization validation, the requests execute with the plugin's intended privileged behavior. The attacker can manipulate recipe content, plugin settings, or other data managed by the plugin.

No verified proof-of-concept code has been published. Refer to the Patchstack Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2024-43293

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php or plugin REST routes originating from low-privileged accounts
Modifications to recipe posts or plugin options made by non-editor accounts
New or altered plugin configuration entries in wp_options without corresponding admin session activity

Detection Strategies

Audit WordPress access logs for authenticated requests to plugin endpoints from subscriber or contributor roles
Compare current plugin version against 3.3.1 using automated inventory scans across WordPress deployments
Correlate user role activity with content changes to identify privilege boundary violations

Monitoring Recommendations

Enable WordPress activity logging to capture role-based action attempts on plugin endpoints
Alert on unusual spikes in admin-ajax.php calls tied to the Recipe Card Blocks action names
Monitor for new low-privilege account creation followed by immediate plugin endpoint activity

How to Mitigate CVE-2024-43293

Immediate Actions Required

Update WPZOOM Recipe Card Blocks for Gutenberg & Elementor to a version later than 3.3.1 once a patched release is available
Disable open user registration on WordPress sites where it is not required
Review existing low-privilege accounts and remove any that are unnecessary or unrecognized

Patch Information

Consult the Patchstack Vulnerability Advisory for the current patched version guidance. Apply the vendor's fixed release through the WordPress plugin update mechanism. Verify the plugin version after update by checking the Plugins page in the WordPress admin console.

Workarounds

Deactivate the Recipe Card Blocks plugin until a patched version is installed if the plugin is not business critical
Restrict access to wp-admin and admin-ajax.php using a web application firewall rule that blocks unauthenticated or low-privileged callers
Enforce strong password policies and multi-factor authentication to reduce the risk of account compromise

bash

# Example WP-CLI commands to inventory and update the plugin
wp plugin list --name=recipe-card-blocks-by-wpzoom --fields=name,status,version
wp plugin update recipe-card-blocks-by-wpzoom