CVE-2024-5324: Xootix Login/Signup Popup Auth Bypass

CVE-2024-5324 Overview

CVE-2024-5324 affects multiple WordPress plugins that share the XootiX Framework. The import_settings function lacks a proper capability check, allowing authenticated users with Subscriber-level access or higher to modify arbitrary site options. Attackers can enable new user registration and set the default role for new users to Administrator, leading to full site takeover. The flaw maps to Missing Authorization [CWE-862] and Incorrect Authorization [CWE-863].

Critical Impact
Authenticated Subscriber-level attackers can escalate to Administrator by manipulating WordPress core options through the unprotected import_settings function.

Affected Products

Xootix Login/Signup Popup plugin for WordPress (versions up to 2.7.2)
Xootix Side Cart WooCommerce plugin (versions up to 2.5)
Xootix OTP Login WooCommerce & Gravity Forms and Waitlist WooCommerce plugins

Discovery Timeline

2024-06-06 - CVE-2024-5324 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5324

Vulnerability Analysis

The XootiX Framework provides shared administrative functionality across several plugins from the same vendor. The framework exposes an import_settings handler in class-xoo-admin-settings.php that processes incoming settings payloads. Because the handler does not verify the caller's WordPress capability, any authenticated session, including a low-privilege Subscriber account, can invoke it.

The function accepts a settings blob and writes the values directly to WordPress options through update_option. Attackers can target sensitive core options such as users_can_register and default_role, turning open registration on and assigning Administrator to any newly registered account. From an Administrator context, the attacker can install plugins, upload PHP code, and take over the underlying site.

Root Cause

The root cause is a Missing Authorization flaw [CWE-862]. The import_settings handler relies on nonce validation for CSRF protection but does not call current_user_can() to confirm the caller has administrative privileges. Because Subscriber accounts can obtain valid nonces from any authenticated context, the missing capability check allows arbitrary option modification.

Attack Vector

Exploitation requires a valid low-privilege account on the target WordPress instance. The attacker sends a crafted POST request to the plugin's admin AJAX endpoint containing a settings payload that redefines users_can_register to 1 and default_role to administrator. After the options are updated, the attacker registers a new account through the standard WordPress registration flow, which is now granted Administrator privileges. See the Wordfence Vulnerability Report for endpoint details and the vulnerable code in class-xoo-admin-settings.php.

Detection Methods for CVE-2024-5324

Indicators of Compromise

Unexpected changes to the users_can_register or default_role values in the wp_options table
New Administrator accounts created shortly after low-privilege user activity
POST requests to admin-ajax.php with XootiX framework action names originating from Subscriber-level sessions
Newly installed plugins or themes uploaded by recently registered accounts

Detection Strategies

Audit the WordPress wp_options table for changes to registration-related options and correlate with plugin activity
Monitor authenticated AJAX traffic to identify Subscriber-level accounts invoking administrative import handlers
Review the WordPress user table for role changes and creation of Administrator accounts outside change-management windows

Monitoring Recommendations

Forward WordPress access logs and audit events to a central data lake for anomaly analysis and long-term retention
Alert on any change to default_role or users_can_register from application logs or database triggers
Track plugin file integrity for the XootiX framework directory to identify tampering or downgrade attempts

How to Mitigate CVE-2024-5324

Immediate Actions Required

Update all XootiX plugins to the latest patched versions available on the WordPress plugin repository
Review the WordPress user list and remove any unauthorized Administrator accounts
Reset the users_can_register and default_role options to their intended values
Rotate credentials for all administrative accounts and invalidate active sessions

Patch Information

The vendor addressed the missing capability check across affected plugins through several commits. Refer to WordPress Changeset #3093994, Changeset #3111541, Changeset #3115392, and Changeset #3117332 for the specific code changes that added the required current_user_can() check to the import_settings handler.

Workarounds

Deactivate any XootiX plugin that cannot be immediately updated
Restrict access to wp-admin/admin-ajax.php for unauthenticated and low-privilege users through a web application firewall rule targeting the XootiX action names
Disable open user registration by unsetting users_can_register and enforcing the value with a must-use plugin until patches are applied

bash

# Verify current WordPress registration settings via WP-CLI
wp option get users_can_register
wp option get default_role

# Force safe defaults until patched plugins are deployed
wp option update users_can_register 0
wp option update default_role subscriber