CVE-2024-5326: PostX Plugin Auth Bypass Vulnerability

CVE-2024-5326 Overview

The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress contains an authorization bypass vulnerability due to a missing capability check on the postx_presets_callback function. This security flaw exists in all versions up to and including 4.1.2, allowing authenticated attackers with Contributor-level access or higher to modify arbitrary WordPress options on affected sites.

Critical Impact

Attackers can exploit this vulnerability to enable new user registration and set the default role for new users to Administrator, effectively achieving privilege escalation and full site takeover.

Affected Products

• Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX versions up to and including 4.1.2
• WordPress installations running vulnerable PostX plugin versions
• Sites with Contributor-level or higher user accounts

Discovery Timeline

• 2024-05-30 - CVE-2024-5326 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-5326

Vulnerability Analysis

This vulnerability represents a Broken Access Control flaw specifically categorized as a Missing Authorization vulnerability. The core issue stems from the postx_presets_callback function in the PostX plugin failing to implement proper capability checks before allowing users to modify WordPress options.

WordPress plugins should implement capability checks using functions like current_user_can() to verify that the requesting user has appropriate permissions before executing privileged operations. In this case, the vulnerable function allows any authenticated user with at least Contributor-level access to invoke functionality that should be restricted to administrators only.

The exploitation scenario is particularly dangerous because attackers can leverage this flaw to modify the users_can_register option (enabling public user registration) and the default_role option (setting it to Administrator). This two-step attack chain allows an attacker to create a new administrator account, achieving complete site compromise.

Root Cause

The root cause is a missing capability check in the postx_presets_callback function located in the classes/Styles.php file. The function processes requests and modifies WordPress options without first verifying that the authenticated user has the appropriate administrative privileges to perform such operations. This violates the principle of least privilege and fails to implement proper authorization controls.

Attack Vector

The attack is conducted over the network and requires authentication with at least Contributor-level privileges. The attacker sends a crafted request to the vulnerable AJAX endpoint or REST API function, bypassing the intended access controls due to the missing capability check. No user interaction is required beyond the initial authentication.

The attack sequence typically involves:

1. Authenticating to WordPress with a Contributor-level account (or higher non-admin role)
2. Sending a request to the postx_presets_callback function with malicious option values
3. Modifying the users_can_register option to enable user registration
4. Setting default_role to administrator
5. Registering a new user account with administrative privileges

For technical details on the vulnerable code paths, refer to the WordPress Plugin Code Reference and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-5326

Indicators of Compromise

• Unexpected changes to WordPress general settings, particularly user registration options
• New administrator accounts created without authorized approval
• Suspicious AJAX requests targeting PostX plugin endpoints from non-admin users
• Audit log entries showing option modifications by Contributor or Author-level users

Detection Strategies

• Monitor WordPress options table for unauthorized modifications to users_can_register and default_role settings
• Review user account creation logs for unexpected administrator registrations
• Implement file integrity monitoring on the PostX plugin directory to detect unauthorized changes
• Configure web application firewall (WAF) rules to detect and block exploitation attempts

Monitoring Recommendations

• Enable comprehensive WordPress audit logging with plugins like WP Activity Log
• Set up alerts for new administrator account creation events
• Monitor HTTP request logs for suspicious patterns targeting /wp-admin/admin-ajax.php with PostX-related actions
• Implement regular review of user roles and capabilities across the WordPress installation

How to Mitigate CVE-2024-5326

Immediate Actions Required

• Update the PostX plugin to version 4.1.3 or later immediately
• Audit all existing WordPress user accounts for unauthorized administrator privileges
• Review recent changes to WordPress general settings, especially registration options
• Temporarily disable the PostX plugin if immediate patching is not possible
• Restrict Contributor-level access to trusted users only until patched

Patch Information

The vulnerability has been addressed in WordPress Changeset 3093815. Site administrators should update to the patched version through the WordPress admin dashboard or by manually downloading the latest release from the WordPress plugin repository.

Workarounds

• If patching is not immediately possible, disable the PostX plugin until an update can be applied
• Remove or demote unnecessary Contributor-level accounts to reduce attack surface
• Implement additional access control layers using security plugins that can restrict AJAX endpoint access
• Deploy a WAF with rules to block unauthorized option modification attempts

# Verify PostX plugin version via WP-CLI
wp plugin list --name=ultimate-post --fields=name,version,update_version

# Update PostX plugin to latest version
wp plugin update ultimate-post

# Audit current administrator accounts
wp user list --role=administrator --fields=ID,user_login,user_registered

# Check current registration settings
wp option get users_can_register
wp option get default_role