CVE-2024-54295: ListApp Mobile Manager Auth Bypass Flaw

CVE-2024-54295 Overview

CVE-2024-54295 is an authentication bypass vulnerability in the FluxBuilder ListApp Mobile Manager WordPress plugin (listapp-mobile-manager). The flaw allows unauthenticated remote attackers to bypass authentication through an alternate path or channel, leading to account takeover. The issue affects all versions of the plugin up to and including 1.7.7. The vulnerability is classified under CWE-288: Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
Unauthenticated attackers can take over arbitrary WordPress accounts, including administrator accounts, on sites running vulnerable versions of the ListApp Mobile Manager plugin.

Affected Products

FluxBuilder ListApp Mobile Manager (listapp-mobile-manager) — all versions up to and including 1.7.7
WordPress installations using the ListApp Mobile Manager plugin
Mobile app backends built using the affected plugin for content management

Discovery Timeline

2024-12-13 - CVE-2024-54295 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-54295

Vulnerability Analysis

The vulnerability arises from improper enforcement of authentication within the ListApp Mobile Manager plugin. The plugin exposes functionality that should require valid authentication, but offers an alternate channel that bypasses the normal authentication path. Attackers reach privileged operations without supplying valid credentials.

Because the plugin is used to power mobile application backends, it implements API endpoints used by mobile clients. These endpoints accept identity claims from the requester. The plugin trusts these claims without correctly validating session integrity or credential proof. An attacker submits a request that mimics a legitimate mobile client and selects an arbitrary user, including administrators.

The outcome is full account takeover. An attacker who takes over a WordPress administrator account can install plugins, modify content, exfiltrate user data, and execute code on the underlying server.

Root Cause

The root cause is classified as [CWE-288]. The plugin enforces authentication on its primary login path but exposes an alternate channel — typically a mobile-facing REST endpoint — where the authentication check is missing, weaker, or based on a parameter the attacker controls. Trusting client-supplied user identifiers without verifying credentials enables identity impersonation.

Attack Vector

The vulnerability is exploitable over the network with no privileges and no user interaction. An attacker sends a crafted HTTP request to the plugin's mobile API endpoint on a vulnerable WordPress site. The request specifies the target user account, and the server returns authentication material or grants access without verifying ownership.

No verified public proof-of-concept code is available. For technical specifics, see the Patchstack WordPress Vulnerability advisory.

Detection Methods for CVE-2024-54295

Indicators of Compromise

Unexpected administrator logins from unfamiliar IP addresses or geolocations in WordPress logs
Requests to listapp-mobile-manager REST API endpoints from non-mobile user agents or in unusual volume
New administrator accounts, plugin installations, or theme uploads not initiated by site administrators
Modified WordPress user records, especially changed email addresses or password hashes for privileged users

Detection Strategies

Audit web server access logs for requests targeting the plugin's mobile API paths and correlate against expected mobile client traffic patterns
Monitor the WordPress wp_users and wp_usermeta tables for unexpected changes to administrator records
Review installed plugin versions across all WordPress sites and flag any instance of listapp-mobile-manager at version 1.7.7 or earlier
Inspect WordPress audit logs for authentication events lacking a corresponding successful login flow

Monitoring Recommendations

Enable a WordPress security audit logging plugin to capture login attempts, user modifications, and privilege changes
Forward web server and WordPress logs to a centralized log analytics platform for correlation and retention
Alert on creation of new administrator users or changes to existing administrator credentials
Track requests to plugin REST routes and baseline normal usage to surface anomalies

How to Mitigate CVE-2024-54295

Immediate Actions Required

Identify all WordPress sites running the ListApp Mobile Manager plugin and confirm the installed version
Disable or uninstall the plugin on sites running version 1.7.7 or earlier until a patched release is confirmed and applied
Reset passwords for all administrator and privileged user accounts and invalidate active sessions
Review user accounts for unauthorized additions or role changes and remove suspicious accounts

Patch Information

At the time of NVD publication, no fixed version is documented in the available references. Consult the Patchstack advisory and the FluxBuilder vendor channels for the latest patch status. Upgrade to a version higher than 1.7.7 once the vendor publishes a fix that explicitly addresses CVE-2024-54295.

Workarounds

Deactivate the listapp-mobile-manager plugin until a verified patch is available
Block external access to the plugin's REST API routes at the web application firewall (WAF) layer
Enforce multi-factor authentication on all WordPress administrator accounts to limit the impact of credential theft
Restrict administrative endpoints by IP allowlist where mobile app traffic patterns permit

bash

# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate listapp-mobile-manager
wp plugin delete listapp-mobile-manager

# Example: block plugin REST routes at the web server (nginx)
location ~* /wp-json/listapp-mobile-manager/ {
    deny all;
    return 403;
}