CVE-2024-7032: Smart Online Order for Clover Auth Bypass

CVE-2024-7032 Overview

CVE-2024-7032 affects the Smart Online Order for Clover plugin for WordPress, developed by Zaytech. The vulnerability exists in all versions up to and including 1.5.6. A missing capability check on the moo_deactivateAndClean function allows unauthenticated attackers to deactivate the plugin and drop all associated database tables. The flaw is classified under CWE-862: Missing Authorization and is exploitable remotely over the network without user interaction.

Critical Impact
Unauthenticated attackers can remotely deactivate the plugin and permanently destroy all plugin database tables, resulting in loss of online ordering data and site functionality.

Affected Products

Zaytech Smart Online Order for Clover plugin for WordPress
All versions up to and including 1.5.6
WordPress sites using the clover-online-orders plugin

Discovery Timeline

2024-08-21 - CVE-2024-7032 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7032

Vulnerability Analysis

The Smart Online Order for Clover plugin exposes a destructive administrative operation through an AJAX handler that lacks authorization enforcement. The moo_deactivateAndClean function is intended to deactivate the plugin and clean up its database footprint. However, the plugin registers the handler without verifying the requesting user's capabilities or validating a nonce. Any unauthenticated visitor to a vulnerable site can invoke the endpoint and trigger the cleanup routine.

The consequence is immediate data destruction. When triggered, the function drops all tables the plugin created to store menu, order, and configuration data. This produces integrity and availability impact on the affected WordPress site, disrupting online ordering operations for Clover point-of-sale integrations.

Root Cause

The root cause is a missing capability check ([CWE-862]) on an AJAX action tied to the moo_deactivateAndClean function. The plugin's deactivator logic in includes/moo-OnlineOrders-deactivator.php performs destructive DROP TABLE operations without wrapping the AJAX entry point registered in moo_OnlineOrders.php in a current_user_can() check or nonce validation. See the WordPress Plugin Code Review and WordPress Plugin Source Code for the affected code paths.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends a crafted HTTP POST request to wp-admin/admin-ajax.php with the vulnerable action parameter set to invoke moo_deactivateAndClean. No authentication, privileges, or user interaction are required. The server executes the deactivation and drop routine, and the plugin's tables are removed from the database. Refer to the Wordfence Vulnerability Analysis for additional technical detail. Public exploit code is not currently available, and the EPSS probability is approximately 0.48%.

// No verified public exploit code is available.
// See external references for technical detail on the vulnerable handler.

Detection Methods for CVE-2024-7032

Indicators of Compromise

Unexpected deactivation of the Smart Online Order for Clover plugin in the WordPress admin interface
Missing plugin database tables prefixed with wp_moo_ (or the site-specific table prefix)
Web server access logs containing POST requests to /wp-admin/admin-ajax.php with an action parameter referencing moo_deactivateAndClean
Sudden loss of stored menu, order, or Clover integration configuration data

Detection Strategies

Inspect HTTP request logs for unauthenticated POST requests targeting admin-ajax.php with the moo_deactivateAndClean action string
Monitor the WordPress database schema for unexpected DROP TABLE operations against plugin-owned tables
Alert on plugin state transitions from active to inactive that were not initiated from an authenticated admin session

Monitoring Recommendations

Enable audit logging for WordPress plugin lifecycle events using a security or activity log plugin
Forward web server and database query logs to a centralized logging platform for correlation
Set alerts on schema-modifying SQL statements originating from the WordPress database user

How to Mitigate CVE-2024-7032

Immediate Actions Required

Update the Smart Online Order for Clover plugin to a version later than 1.5.6 as soon as it is available
Restrict access to /wp-admin/admin-ajax.php at the web application firewall (WAF) layer to block requests invoking the moo_deactivateAndClean action from unauthenticated sources
Back up the WordPress database, including plugin tables, before applying patches or performing recovery
Review database and plugin state to confirm no unauthorized deactivation or table drops have already occurred

Patch Information

The vendor addressed the missing capability check in WordPress Changeset #3142846. Site administrators should upgrade to the patched release published after this changeset. Verify the installed plugin version through the WordPress plugin management interface after the update.

Workarounds

Deactivate and remove the Smart Online Order for Clover plugin until it can be updated to a patched version
Deploy a WAF rule that blocks POST requests to admin-ajax.php containing the moo_deactivateAndClean action parameter from unauthenticated sessions
Restrict access to the WordPress admin surface using IP allowlisting or HTTP authentication where feasible

bash

# Example WAF rule concept (ModSecurity) to block unauthenticated invocation
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,id:1007032,phase:2,deny,status:403,msg:'Block CVE-2024-7032 exploit attempt'"
  SecRule ARGS:action "@streq moo_deactivateAndClean"