CVE-2024-43968: Automattic Newspack Auth Bypass Flaw

CVE-2024-43968 Overview

CVE-2024-43968 is a broken access control vulnerability in the Automattic Newspack WordPress plugin. The flaw affects all versions of Newspack up to and including 3.8.6. It stems from incorrectly configured access control security levels [CWE-862], allowing authenticated users with low privileges to perform actions restricted to higher-privileged roles. The vulnerability is network-exploitable with low attack complexity and requires only low-level authentication. Successful exploitation compromises confidentiality, integrity, and availability of the affected WordPress installation.

Critical Impact
Authenticated attackers with minimal privileges can bypass access controls in Newspack to reach restricted functionality, leading to full compromise of confidentiality, integrity, and availability on the affected WordPress site.

Affected Products

Automattic Newspack plugin for WordPress
All versions from n/a through 3.8.6
WordPress sites running the Newspack publishing platform

Discovery Timeline

2024-11-01 - CVE-2024-43968 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43968

Vulnerability Analysis

The Newspack plugin provides publishing tools for news organizations built on WordPress. The vulnerability originates from missing or improperly enforced authorization checks on sensitive plugin endpoints. Attackers holding a low-privileged authenticated session, such as a subscriber or contributor role, can invoke functionality intended for editors or administrators. This class of flaw is tracked as CWE-862: Missing Authorization.

The issue enables cross-role action execution within Newspack. Because Newspack manages content publishing, subscriptions, and reader data, an attacker who bypasses access controls can modify posts, alter site configuration, or reach data available only to trusted staff. The Patchstack advisory confirms remediation in Newspack 3.8.7.

Root Cause

The root cause is incorrectly configured access control security levels within Newspack request handlers. The affected code paths do not verify that the current user holds the WordPress capability required for the requested operation. This omission allows any authenticated session to reach privileged logic without a capability check such as current_user_can().

Attack Vector

An attacker first obtains a low-privileged account on a target WordPress site running Newspack 3.8.6 or earlier. The attacker then issues crafted HTTP requests directly to the vulnerable Newspack endpoints. Because the endpoints do not enforce role or capability checks, the requests execute with the attacker's session but perform higher-privileged actions. No user interaction from a victim is required. Full technical details are available in the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-43968

Indicators of Compromise

Unexpected changes to posts, pages, or Newspack configuration made by low-privileged accounts
Access log entries showing subscriber or contributor accounts calling Newspack REST or AJAX endpoints normally reserved for editors
New or elevated user accounts created without administrator activity
Modifications to reader revenue, donation, or subscription settings outside the change window

Detection Strategies

Audit WordPress user role assignments and cross-reference actions performed against expected capabilities for each role
Compare the installed Newspack version against 3.8.7 across managed WordPress properties
Review WordPress wp-content/plugins/newspack-plugin for the presence of missing capability checks by inspecting file versions and hashes
Correlate authentication events with subsequent privileged Newspack API calls to identify role mismatches

Monitoring Recommendations

Enable verbose WordPress and web server logging to capture the requesting user, endpoint, and HTTP status for all Newspack requests
Forward WordPress and reverse proxy logs into a central analytics platform for role-based anomaly detection
Alert on any low-privileged account issuing POST or DELETE requests to Newspack administrative routes
Track plugin file integrity to identify unauthorized changes following suspected exploitation

How to Mitigate CVE-2024-43968

Immediate Actions Required

Upgrade the Newspack plugin to version 3.8.7 or later on every affected WordPress site
Review all non-administrator accounts and remove accounts that are unknown or unused
Rotate credentials for any account that showed suspicious Newspack endpoint activity
Audit recent content and configuration changes for unauthorized modifications

Patch Information

Automattic addressed the flaw in Newspack version 3.8.7 by adding the missing authorization checks. Site operators should update through the WordPress plugin manager or by deploying the fixed release artifact. Confirm the running version through the WordPress admin interface after the update. Refer to the Patchstack Vulnerability Report for advisory details.

Workarounds

Restrict user registration on sites where new low-privileged accounts are not required
Place the WordPress admin and REST API behind a web application firewall with rules that limit sensitive Newspack routes to trusted roles
Temporarily disable the Newspack plugin on sites that cannot immediately update to 3.8.7
Enforce strong authentication and two-factor authentication for all WordPress accounts to raise the cost of obtaining a foothold

bash

# Update Newspack via WP-CLI to the patched release
wp plugin update newspack-plugin --version=3.8.7
wp plugin get newspack-plugin --field=version