CVE-2024-44021: Truepush Auth Bypass Vulnerability

CVE-2024-44021 Overview

CVE-2024-44021 is a Missing Authorization vulnerability [CWE-862] affecting the Truepush WordPress plugin truepush-free-web-push-notifications. The flaw exists in all versions up through 1.0.8. Authenticated attackers with low privileges can invoke plugin functions that lack proper authorization checks. Successful exploitation impacts confidentiality, integrity, and availability of the affected WordPress installation. The issue is tracked as a broken access control weakness in the Patchstack database.

Critical Impact
Authenticated low-privilege users can bypass authorization controls in the Truepush plugin to perform actions restricted to higher-privileged roles, compromising WordPress site integrity.

Affected Products

Truepush truepush-free-web-push-notifications WordPress plugin
All versions from n/a through 1.0.8
WordPress sites with the plugin installed and activated

Discovery Timeline

2024-11-01 - CVE-2024-44021 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-44021

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw classified under [CWE-862]. The Truepush plugin exposes functionality that fails to verify whether the requesting user holds the required capability or role. As a result, authenticated users with minimal privileges (such as subscribers) can invoke actions intended for administrators. The attack requires network access and low privileges, with no user interaction. Consequences include unauthorized modification of plugin settings, disclosure of configuration data, and disruption of push notification functionality on the affected site.

Root Cause

The root cause is the absence of capability checks (for example, current_user_can()) or nonce validation on sensitive plugin endpoints. WordPress plugins commonly register AJAX actions or admin-post handlers that must independently enforce authorization. In this plugin, at least one such handler processes requests without verifying the caller's role, allowing broken access control.

Attack Vector

An attacker authenticates to the target WordPress site using any valid low-privilege account, including self-registered subscriber accounts on sites that permit open registration. The attacker then issues an HTTP request to the vulnerable plugin endpoint, typically wp-admin/admin-ajax.php with the plugin's registered action parameter. Because the handler does not enforce authorization, the request executes with the plugin's intended administrative scope. See the Patchstack Vulnerability Report for additional technical detail.

// No verified public exploit code is available for CVE-2024-44021.
// Refer to the Patchstack advisory for technical details.

Detection Methods for CVE-2024-44021

Indicators of Compromise

Unexpected changes to Truepush plugin settings or push notification configurations
POST requests from low-privilege authenticated sessions to admin-ajax.php referencing Truepush plugin actions
New or modified push notification subscriber lists that do not correspond to legitimate admin activity
WordPress audit log entries showing plugin option updates performed by non-administrator accounts

Detection Strategies

Inventory WordPress installations for the truepush-free-web-push-notifications plugin and confirm versions at or below 1.0.8
Review web server access logs for authenticated requests to plugin AJAX endpoints originating from subscriber or contributor accounts
Correlate WordPress user role activity with changes to wp_options entries owned by the Truepush plugin

Monitoring Recommendations

Enable a WordPress activity logging plugin to record option changes and AJAX action invocations
Alert on HTTP 200 responses to Truepush plugin endpoints requested by non-administrator sessions
Monitor for spikes in newly registered low-privilege accounts followed by administrative actions

How to Mitigate CVE-2024-44021

Immediate Actions Required

Update the Truepush plugin to a version later than 1.0.8 once released by the vendor
Deactivate and remove the plugin if a patched version is not available and the functionality is not required
Restrict WordPress user registration to trusted roles and disable open subscriber registration where feasible
Rotate credentials for any low-privilege accounts that show suspicious activity against plugin endpoints

Patch Information

At the time of publication, the Patchstack advisory identifies versions through 1.0.8 as affected. Site administrators should consult the Patchstack Vulnerability Report and the plugin's WordPress.org listing for the latest release information.

Workarounds

Deploy a Web Application Firewall (WAF) rule to block requests to Truepush plugin AJAX actions from non-administrator sessions
Use a WordPress access control plugin to restrict capabilities exposed by Truepush endpoints
Disable the plugin until a vendor-supplied patch is verified in a staging environment

bash

# Example: disable the Truepush plugin via WP-CLI until a fix is available
wp plugin deactivate truepush-free-web-push-notifications
wp plugin list --name=truepush-free-web-push-notifications --fields=name,status,version