CVE-2024-49657: 3D Work In Progress Auth Bypass Flaw

CVE-2024-49657 Overview

CVE-2024-49657 is a Missing Authorization vulnerability in the Renata Bracichowicz 3D Work In Progress WordPress plugin (renee-work-in-progress). The flaw affects all versions up to and including 1.0.3. Authenticated low-privileged users can exploit incorrectly configured access control checks to trigger arbitrary file deletion on the WordPress host. The issue is cataloged under CWE-862: Missing Authorization and was published to NVD on October 23, 2024.

Critical Impact
Authenticated attackers with minimal privileges can delete arbitrary files on the server, which can lead to site outage or a follow-on takeover when critical files such as wp-config.php are removed.

Affected Products

3D Work In Progress WordPress plugin (renee-work-in-progress)
All versions from n/a through 1.0.3
WordPress installations running the vulnerable plugin

Discovery Timeline

2024-10-23 - CVE-2024-49657 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49657

Vulnerability Analysis

The 3D Work In Progress plugin exposes functionality that performs file deletion without validating whether the calling user is authorized to invoke it. According to the Patchstack Vulnerability Report, the resulting condition is arbitrary file deletion. An authenticated user with low privileges, such as a subscriber, can invoke the vulnerable action against files outside the plugin's intended scope. Because the impact crosses a security boundary, the CVSS scope is marked as Changed, and availability is fully compromised.

Root Cause

The root cause is a missing capability or nonce-driven authorization check on a plugin action handler. The plugin registers a file operation endpoint accessible to authenticated users but does not enforce a current_user_can() capability gate or verify user intent through a valid nonce. As a result, any authenticated user session can reach the deletion routine regardless of role.

Attack Vector

Exploitation requires network access to the WordPress site and a valid low-privileged account. The attacker sends a crafted request to the plugin's action endpoint (typically over admin-ajax.php or an admin-post handler) supplying a target file path. Because no capability check is enforced, the server executes the deletion under the WordPress process account. Deleting core files such as wp-config.php can force WordPress into the setup workflow, enabling a full site takeover if the attacker connects the site to an attacker-controlled database.

No verified public proof-of-concept code is available. The Patchstack advisory documents the arbitrary file deletion behavior without releasing exploit payloads.

Detection Methods for CVE-2024-49657

Indicators of Compromise

Unexpected POST requests to admin-ajax.php or admin-post endpoints from subscriber-level accounts referencing the renee-work-in-progress plugin.
Sudden absence of wp-config.php, .htaccess, or theme and plugin files without a corresponding administrator action.
WordPress reverting to the installation wizard (/wp-admin/install.php) unexpectedly.
Web server error logs showing PHP file-not-found errors immediately after authenticated plugin requests.

Detection Strategies

Monitor WordPress audit logs for plugin action calls originating from non-administrative roles.
Inspect access logs for parameters containing directory traversal sequences (../) directed at plugin endpoints.
File integrity monitoring on the WordPress document root to flag unauthorized deletions in real time.

Monitoring Recommendations

Alert on any deletion of wp-config.php, wp-load.php, or files under wp-content/plugins/ outside of maintenance windows.
Correlate authenticated user session activity with filesystem write and unlink events on the web host.
Track installations of the renee-work-in-progress plugin across managed WordPress fleets to identify exposed sites.

How to Mitigate CVE-2024-49657

Immediate Actions Required

Deactivate and remove the 3D Work In Progress plugin until a patched release is confirmed by the vendor.
Audit WordPress user accounts and revoke unnecessary low-privileged accounts that could reach the vulnerable endpoint.
Back up wp-config.php and the full WordPress document root offline before any remediation work.

Patch Information

At the time of NVD publication, no fixed version above 1.0.3 was listed in the advisory. Consult the Patchstack Vulnerability Report for the current fix status and upgrade guidance before reinstalling the plugin.

Workarounds

Block requests to the plugin's action handlers at the web application firewall for non-administrator sessions.
Restrict user registration and disable open subscriber sign-ups on affected sites.
Enforce filesystem permissions so the web server account cannot delete configuration or core WordPress files.

bash

# Example: remove the vulnerable plugin using WP-CLI
wp plugin deactivate renee-work-in-progress
wp plugin delete renee-work-in-progress