CVE-2024-54379: Minterpress Privilege Escalation Flaw

CVE-2024-54379 Overview

CVE-2024-54379 is a Missing Authorization vulnerability [CWE-862] in the blokhauswp Minterpress WordPress plugin. The flaw affects all versions of Minterpress up to and including 1.0.5. Attackers with low-level authenticated access can exploit missing authorization checks to update arbitrary WordPress options, leading to privilege escalation. Successful exploitation grants the attacker administrative control over the affected WordPress site. The vulnerability was published to the National Vulnerability Database (NVD) on December 16, 2024.

Critical Impact
An authenticated attacker with minimal privileges can update arbitrary WordPress options to escalate to administrator, resulting in full site compromise including code execution, data theft, and content manipulation.

Affected Products

blokhauswp Minterpress plugin versions through 1.0.5
WordPress installations running vulnerable Minterpress releases
Sites where low-privilege users can authenticate to the WordPress backend

Discovery Timeline

2024-12-16 - CVE-2024-54379 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54379

Vulnerability Analysis

The vulnerability stems from missing authorization checks in the Minterpress plugin's option-update functionality. The plugin exposes endpoints or actions that modify WordPress options without validating whether the requesting user holds the required capability. Authenticated users with low privileges, such as subscribers, can invoke these actions and change site-wide configuration values.

Because WordPress stores critical settings such as default_role, users_can_register, admin_email, and siteurl in the options table, arbitrary option updates translate directly into privilege escalation. An attacker can set the default registration role to administrator and enable open registration, then create a new administrator account.

The attack vector is network-based and requires low privileges with no user interaction. The impact spans confidentiality, integrity, and availability, since administrator access on WordPress permits plugin installation and PHP execution.

Root Cause

The root cause is an absent capability check [CWE-862]. Vulnerable handlers do not invoke current_user_can() with an appropriate capability such as manage_options, and they also lack nonce validation via check_admin_referer() or wp_verify_nonce(). Any authenticated request reaching the handler is treated as authorized.

Attack Vector

An attacker registers or authenticates as a low-privilege WordPress user. The attacker then sends a crafted request to the vulnerable Minterpress endpoint, passing an arbitrary WordPress option name and value. By modifying options such as default_role and users_can_register, the attacker escalates newly registered accounts to administrator. See the Patchstack Vulnerability Report for technical details.

No public proof-of-concept exploit code has been released for this vulnerability at the time of this writing.

Detection Methods for CVE-2024-54379

Indicators of Compromise

Unexpected changes to WordPress options such as default_role, users_can_register, admin_email, or siteurl in the wp_options table
New administrator accounts created shortly after requests to Minterpress plugin endpoints
HTTP POST or AJAX requests to admin-ajax.php referencing Minterpress actions from low-privilege user sessions
Installation of unfamiliar plugins or themes following suspicious authenticated activity

Detection Strategies

Monitor the WordPress wp_options table for unauthorized modifications, particularly to role and registration settings
Alert on privilege changes and administrator account creation events in WordPress audit logs
Inspect web server logs for authenticated requests to Minterpress endpoints originating from subscriber or contributor accounts
Correlate plugin-specific AJAX actions with subsequent option changes to identify exploitation chains

Monitoring Recommendations

Deploy a WordPress activity logging plugin to capture option changes, role modifications, and user creation events
Forward WordPress and web server logs to a centralized SIEM for correlation and long-term retention
Baseline normal administrative activity and alert on deviations such as option updates from non-administrator sessions
Review scheduled tasks (wp_cron) and installed plugins regularly for unauthorized additions

How to Mitigate CVE-2024-54379

Immediate Actions Required

Deactivate and remove the Minterpress plugin until a patched release is available and verified
Audit all WordPress administrator accounts and remove any that were not explicitly created by trusted personnel
Reset passwords for all privileged accounts and rotate WordPress authentication keys and salts in wp-config.php
Review wp_options values for default_role, users_can_register, siteurl, and home and restore expected values

Patch Information

At the time of publication, no fixed version of Minterpress beyond 1.0.5 is referenced in the CVE record. Administrators should consult the Patchstack Vulnerability Report for the latest remediation guidance and monitor the plugin repository for an updated release.

Workarounds

Remove the Minterpress plugin entirely if a patched version is not yet available
Restrict new user registration by setting users_can_register to 0 and enforce administrator-approved onboarding
Apply a Web Application Firewall (WAF) rule to block requests targeting vulnerable Minterpress AJAX actions from non-administrator sessions
Limit access to wp-admin and admin-ajax.php by IP allowlisting where operationally feasible

bash

# Configuration example: disable open registration and enforce subscriber default role
wp option update users_can_register 0
wp option update default_role subscriber

# Remove the vulnerable plugin
wp plugin deactivate minterpress
wp plugin delete minterpress