CVE-2024-56238 Overview
CVE-2024-56238 is a missing authorization vulnerability in the QuantumCloud Floating Action Buttons plugin for WordPress. The flaw affects all plugin versions up to and including 0.9.1. The plugin exposes functionality that is not properly constrained by access control lists (ACLs), allowing unauthenticated attackers to invoke actions reserved for privileged users. The weakness maps to CWE-862: Missing Authorization. Attackers can reach the vulnerable endpoints remotely over the network without user interaction, resulting in a limited impact to availability.
Critical Impact
Remote, unauthenticated attackers can access protected plugin functionality on WordPress sites running Floating Action Buttons <= 0.9.1, affecting site availability.
Affected Products
- QuantumCloud Floating Action Buttons WordPress plugin, versions up to and including 0.9.1
- WordPress sites with the floating-action-buttons plugin installed and activated
- Any hosting environment serving the vulnerable plugin version
Discovery Timeline
- 2025-01-02 - CVE-2024-56238 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-56238
Vulnerability Analysis
The Floating Action Buttons plugin exposes one or more handlers that fail to verify the caller's authorization before executing privileged actions. Under the broken access control pattern described by CWE-862, the plugin either omits capability checks (such as current_user_can()) or relies on client-side gating that attackers trivially bypass.
The attack is network-reachable and requires no authentication or user interaction. According to the EPSS model, this issue carries a probability of 0.473% for exploitation in the next 30 days.
Root Cause
The root cause is the absence of a server-side authorization check on administrative or state-changing functionality within the plugin. WordPress plugins typically protect privileged AJAX actions and REST routes using capability checks and nonces. In vulnerable builds of floating-action-buttons, those checks are missing or inadequate, so handlers accept requests from unauthenticated visitors.
Attack Vector
An attacker sends crafted HTTP requests to the plugin's exposed endpoints, such as admin-ajax.php actions or custom REST routes registered by the plugin. Because no capability or role check is enforced, the server processes the request as if it originated from an authorized user. The CVSS vector reflects impact limited to availability, consistent with abuse of configuration or state-changing handlers that can disrupt plugin behavior on the site.
For technical specifics, consult the Patchstack Vulnerability Report.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2024-56238
Indicators of Compromise
- Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing plugin actions tied to floating-action-buttons.
- Requests to plugin REST routes under /wp-json/ originating from unauthenticated sessions.
- Unexpected modifications to Floating Action Buttons configuration or settings records in the WordPress database.
Detection Strategies
- Review web server access logs for repeated POST traffic to plugin endpoints without an authenticated session cookie.
- Enable WordPress audit logging to capture changes to plugin settings and option values.
- Correlate requests to floating-action-buttons handlers with source IP reputation and request frequency to identify abuse.
Monitoring Recommendations
- Alert on high-volume or anomalous requests targeting plugin AJAX and REST endpoints.
- Monitor plugin version inventory across WordPress estates to confirm all instances exceed 0.9.1.
- Track outbound responses from affected endpoints for unexpected status codes or payload sizes.
How to Mitigate CVE-2024-56238
Immediate Actions Required
- Upgrade the Floating Action Buttons plugin to a release later than 0.9.1 as soon as a fixed version is published by QuantumCloud.
- If no fixed version is available, deactivate and remove the plugin from affected WordPress sites.
- Audit the WordPress installation for unauthorized configuration changes made through the vulnerable handlers.
Patch Information
At the time of publication, the vulnerability is reported against versions up to and including 0.9.1. Refer to the Patchstack Vulnerability Report for the current fixed-version status and vendor remediation guidance.
Workarounds
- Restrict access to /wp-admin/admin-ajax.php and plugin REST routes at the web application firewall for unauthenticated clients where feasible.
- Apply virtual patching rules that block requests to the specific plugin actions registered by floating-action-buttons.
- Limit administrative access to the WordPress site by IP allowlisting until the plugin is updated or removed.
# Example: disable the plugin via WP-CLI until a fixed version is installed
wp plugin deactivate floating-action-buttons
wp plugin delete floating-action-buttons
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
