CVE-2024-5541 Overview
The Ibtana – WordPress Website Builder plugin contains a missing authorization vulnerability [CWE-862] in the ibtana_visual_editor_register_ajax_json_endpont function. All versions up to and including 1.2.3.3 are affected. The function lacks a capability check, allowing unauthenticated attackers to modify WordPress option values used for reCAPTCHA keys. Attackers can leverage this behavior to bypass reCAPTCHA protections on the affected site. According to the advisory, CVE-2024-37123 is likely a duplicate of this issue.
Critical Impact
Unauthenticated attackers can overwrite reCAPTCHA option values, disabling bot protection and enabling automated abuse of forms and login endpoints.
Affected Products
- Vowelweb Ibtana – WordPress Website Builder plugin
- All versions through 1.2.3.3
- WordPress installations that expose the plugin's AJAX endpoint
Discovery Timeline
- 2024-06-18 - CVE-2024-5541 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-5541
Vulnerability Analysis
The plugin registers an AJAX endpoint through the ibtana_visual_editor_register_ajax_json_endpont handler. The handler updates WordPress option values that store reCAPTCHA site and secret keys. It does not verify the caller's capabilities or authentication state before performing the update.
An attacker sends a crafted request to the plugin's AJAX endpoint. The endpoint accepts attacker-supplied values and writes them into the WordPress options table. Because the plugin uses these options to render and validate reCAPTCHA challenges, replacing them with attacker-controlled or invalid keys causes reCAPTCHA validation to fail open or be bypassed.
The issue is scoped to integrity of plugin configuration rather than direct code execution. However, disabling reCAPTCHA opens downstream attack surface such as credential stuffing, spam submissions, and automated enumeration against forms protected by the plugin. Additional technical context is available in the Wordfence Vulnerability Report.
Root Cause
The root cause is a missing capability check [CWE-862] on an AJAX handler that modifies persistent site options. The function does not call current_user_can() or verify a nonce, so any unauthenticated request reaches the option update logic. The vulnerable code path can be reviewed in the WordPress Plugin Settings Code.
Attack Vector
Exploitation occurs over the network against the WordPress admin-ajax.php endpoint. The attacker requires no authentication and no user interaction. A single HTTP POST request with the vulnerable action parameter and attacker-chosen option values is sufficient to overwrite the reCAPTCHA keys stored by the plugin.
// No verified public exploit code is available for CVE-2024-5541.
// Refer to the vendor changeset for the patched handler:
// https://plugins.trac.wordpress.org/changeset/3103454/ibtana-visual-editor/trunk/admin/settings.php
Detection Methods for CVE-2024-5541
Indicators of Compromise
- Unexpected changes to WordPress options that store reCAPTCHA site or secret keys on sites running the Ibtana plugin.
- POST requests to wp-admin/admin-ajax.php referencing the ibtana_visual_editor_register_ajax_json_endpont action from unauthenticated sessions.
- A sudden rise in successful form submissions, comment spam, or login attempts on endpoints previously protected by reCAPTCHA.
Detection Strategies
- Inventory WordPress sites and flag any installation of the Ibtana – WordPress Website Builder plugin at version 1.2.3.3 or earlier.
- Alert on HTTP requests to admin-ajax.php whose action parameter matches the vulnerable handler and whose session cookies indicate no authenticated user.
- Baseline the WordPress wp_options table for reCAPTCHA-related keys and generate alerts on unauthorized modifications.
Monitoring Recommendations
- Forward web server access logs and WordPress audit logs to a centralized analytics platform for correlation.
- Monitor for automated activity patterns on forms and login pages that indicate reCAPTCHA is no longer enforced.
- Track plugin version data from vulnerability scanners to confirm remediation across all managed WordPress sites.
How to Mitigate CVE-2024-5541
Immediate Actions Required
- Update the Ibtana – WordPress Website Builder plugin to a version later than 1.2.3.3 on every affected WordPress site.
- Rotate reCAPTCHA site and secret keys in the Google reCAPTCHA console after patching and restore the correct values in the plugin settings.
- Review WordPress audit logs for prior modifications to reCAPTCHA option values and reset any that appear tampered.
Patch Information
The vendor addressed the missing capability check in the plugin repository. Review the fix in the WordPress Plugin Changeset Update and deploy the corresponding released version through the WordPress plugin updater.
Workarounds
- Deactivate and remove the Ibtana plugin until the patched version can be deployed.
- Block unauthenticated POST requests to admin-ajax.php that carry the ibtana_visual_editor_register_ajax_json_endpont action using a web application firewall (WAF) rule.
- Restrict access to wp-admin/admin-ajax.php from untrusted networks where business requirements permit.
# Example WAF rule concept: block unauthenticated calls to the vulnerable action
# ModSecurity-style pseudo rule
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
"chain,deny,status:403,id:1005541,msg:'Block CVE-2024-5541 Ibtana AJAX abuse'"
SecRule ARGS:action "@streq ibtana_visual_editor_register_ajax_json_endpont" \
"chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
