CVE-2024-50417: Bold Page Builder Auth Bypass Flaw

CVE-2024-50417 Overview

CVE-2024-50417 is a missing authorization vulnerability in the boldthemes Bold Page Builder plugin for WordPress. The flaw affects all versions up to and including 5.1.3. The plugin fails to enforce proper access control checks, allowing authenticated users with low privileges to invoke functionality reserved for higher-privileged roles. This weakness maps to CWE-862: Missing Authorization. The issue impacts confidentiality, integrity, and availability of affected WordPress sites.

Critical Impact
Authenticated attackers can exploit incorrectly configured access control levels to perform unauthorized actions on WordPress sites running Bold Page Builder <= 5.1.3.

Affected Products

boldthemes Bold Page Builder plugin for WordPress
All versions from n/a through 5.1.3
WordPress sites with the bold-page-builder plugin installed and activated

Discovery Timeline

2024-11-19 - CVE-2024-50417 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50417

Vulnerability Analysis

The Bold Page Builder plugin exposes plugin actions and endpoints without validating whether the calling user has sufficient privileges. Attackers authenticated at low privilege levels, such as subscriber or contributor, can invoke functionality intended for administrators. The vulnerability originates from broken access control logic rather than missing authentication, so any authenticated session is enough to reach the exposed handlers. Successful exploitation can lead to unauthorized configuration changes, content manipulation, and further compromise of the WordPress installation. The Exploit Prediction Scoring System places this vulnerability in the upper range of likelihood for near-term exploitation activity against WordPress plugins.

Root Cause

The root cause is a missing or incorrectly configured capability check inside the plugin's action handlers. Endpoints registered by the plugin do not verify user capabilities using functions such as current_user_can(), and they do not validate nonces consistently. Because WordPress delegates authorization to the plugin's own code, any handler that omits this check becomes reachable by lower-privileged authenticated users.

Attack Vector

Exploitation requires network access to the target WordPress site and a valid authenticated session with low privileges. The attacker sends a crafted HTTP request to a plugin action endpoint that lacks the appropriate capability check. Because the plugin operates within the WordPress request lifecycle, the request is processed as if it originated from an authorized user. No user interaction is required beyond initial authentication, and the attack complexity is low. Detailed technical analysis is available in the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2024-50417

Indicators of Compromise

Unexpected POST requests to admin-ajax.php referencing Bold Page Builder actions from low-privileged user accounts
Unauthorized modifications to page templates, sections, or plugin settings created by non-administrator accounts
New or altered posts and pages containing content injected through the Bold Page Builder editor without a corresponding administrator audit trail

Detection Strategies

Review WordPress access logs for requests to Bold Page Builder action endpoints originating from subscriber, contributor, or author accounts
Correlate plugin activity with the WordPress user role table to identify actions performed outside the caller's assigned capabilities
Enable and inspect WordPress audit logging plugins to capture privilege-sensitive actions triggered through the plugin

Monitoring Recommendations

Alert on any authenticated request to Bold Page Builder AJAX handlers from accounts below the editor role
Monitor the wp_options, wp_posts, and wp_postmeta tables for unexpected writes referencing Bold Page Builder settings
Track spikes in admin-ajax.php traffic against baseline patterns for the site

How to Mitigate CVE-2024-50417

Immediate Actions Required

Update the Bold Page Builder plugin to a version later than 5.1.3 as soon as a fixed release is available
Audit all WordPress user accounts and remove or downgrade unnecessary low-privilege accounts that could be used for exploitation
Rotate credentials for any accounts that show suspicious activity against Bold Page Builder endpoints

Patch Information

Upgrade the Bold Page Builder plugin to a version above 5.1.3. Consult the Patchstack advisory for the latest fixed release information and vendor guidance.

Workarounds

Deactivate and remove the Bold Page Builder plugin until a patched version is deployed if an upgrade is not immediately possible
Restrict registration and disable open sign-up to reduce the pool of low-privileged authenticated users
Deploy a web application firewall rule that blocks unauthenticated and low-privileged requests to Bold Page Builder action endpoints

bash

# Configuration example: disable open user registration in WordPress
wp option update users_can_register 0
wp option update default_role subscriber