CVE-2024-47330: Supsystic Slider Auth Bypass Vulnerability

CVE-2024-47330 Overview

CVE-2024-47330 is a Missing Authorization vulnerability [CWE-862] affecting two WordPress plugins from Supsystic: Slider by Supsystic and Social Share Buttons by Supsystic. The issue affects Slider by Supsystic versions up to and including 1.8.6 and Social Share Buttons by Supsystic versions up to and including 2.2.9. A network-based attacker with low-level authenticated access can invoke privileged plugin actions that lack proper access control checks. Successful exploitation impacts confidentiality, integrity, and availability of the affected WordPress site.

Critical Impact
An authenticated attacker with minimal privileges can perform administrative plugin operations on affected WordPress sites, leading to full compromise of plugin configuration and stored data.

Affected Products

Supsystic Slider for WordPress: versions up to and including 1.8.6
Supsystic Social Share Buttons for WordPress: versions up to and including 2.2.9
WordPress installations running either plugin without the vendor patch

Discovery Timeline

2024-09-26 - CVE-2024-47330 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47330

Vulnerability Analysis

The vulnerability is a broken access control flaw in the Supsystic Slider and Social Share Buttons plugins for WordPress. Sensitive plugin endpoints do not verify whether the requesting user holds the correct capability or role before performing privileged operations. Any authenticated user, including low-privilege accounts such as subscriber, can invoke plugin actions that should be restricted to administrators. The result is a broad exposure of plugin configuration and stored data to any authenticated site user.

Root Cause

The root cause is a Missing Authorization weakness [CWE-862]. Plugin action handlers accept requests from authenticated users without calling current_user_can() or an equivalent capability check. Combined with insufficient nonce validation on privileged handlers, the plugins expose administrative functionality to any signed-in account.

Attack Vector

Exploitation requires network access and a valid authenticated session on the target WordPress instance. The attacker sends crafted requests to vulnerable plugin AJAX or admin-post endpoints exposed by the Supsystic Slider or Social Share Buttons plugins. No user interaction is required, and the attack complexity is low. Refer to the Patchstack Vulnerability Report: Slider Plugin and Patchstack Vulnerability Report: Social Share Plugin for endpoint-level detail.

No verified public exploit code is available at the time of writing. The vulnerability mechanism can be described in prose: an authenticated HTTP POST request to a Supsystic plugin action handler bypasses capability checks and executes privileged plugin logic under the attacker's session.

Detection Methods for CVE-2024-47330

Indicators of Compromise

Unexpected changes to slider configurations, share button settings, or plugin-managed content by non-administrator accounts
HTTP POST requests to admin-ajax.php referencing Supsystic plugin actions (for example, action names beginning with supsystic or sup_) from low-privilege user sessions
New or modified slider records, share button placements, or plugin database entries without a corresponding administrator activity log entry
WordPress user accounts created or modified shortly after suspicious plugin requests

Detection Strategies

Enumerate installed WordPress plugins and flag hosts running Slider by Supsystic <= 1.8.6 or Social Share Buttons by Supsystic <= 2.2.9
Correlate authenticated user role with admin-ajax.php requests: alert when non-administrator users invoke Supsystic plugin actions
Baseline normal plugin activity and detect deviations in request rate or parameter patterns against Supsystic endpoints

Monitoring Recommendations

Ingest WordPress access logs and audit logs into a centralized SIEM for role-based query and correlation
Monitor for privilege discrepancies between the user role and the action being invoked on plugin endpoints
Track plugin-file integrity to identify unauthorized modifications to Supsystic plugin data or configuration tables

How to Mitigate CVE-2024-47330

Immediate Actions Required

Update Slider by Supsystic to a version later than 1.8.6 and Social Share Buttons by Supsystic to a version later than 2.2.9 as soon as the vendor releases a fixed release
Inventory all WordPress sites in the environment and identify installations running either affected plugin
Review WordPress user accounts and remove or downgrade unused low-privilege accounts that could be leveraged for exploitation
Audit plugin-managed content and configuration for unauthorized changes since the plugins were installed

Patch Information

Refer to the vendor advisories referenced by Patchstack for fixed version guidance: Patchstack Vulnerability Report: Slider Plugin and Patchstack Vulnerability Report: Social Share Plugin. Apply updates through the WordPress plugin manager or via wp-cli once a patched release is available.

Workarounds

Deactivate and remove the Supsystic Slider and Social Share Buttons plugins until a patched version is installed
Restrict access to admin-ajax.php and wp-admin using a web application firewall rule that blocks Supsystic plugin actions from non-administrator sessions
Enforce strong registration controls and disable open user registration on public WordPress sites to reduce the pool of low-privilege attacker accounts

bash

# Configuration example: list and update affected Supsystic plugins with wp-cli
wp plugin list --format=table | grep -E 'slider-by-supsystic|social-share-buttons-by-supsystic'
wp plugin update slider-by-supsystic
wp plugin update social-share-buttons-by-supsystic
# If no patched release is available, deactivate:
wp plugin deactivate slider-by-supsystic social-share-buttons-by-supsystic