CVE-2024-7390: WP Testimonial Widget Auth Bypass Vulnerability

CVE-2024-7390 Overview

CVE-2024-7390 is a broken access control vulnerability in the WP Testimonial Widget plugin for WordPress developed by starkdigital. The flaw affects all versions up to and including 3.1. The plugin's fnSaveTestimonailOrder function lacks a capability check, allowing unauthenticated attackers to modify the display order of testimonials on affected sites. The vulnerability is categorized under [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated attackers can send network requests to reorder testimonial content on any WordPress site running the vulnerable plugin, resulting in low-severity integrity impact without requiring authentication or user interaction.

Affected Products

starkdigital WP Testimonial Widget plugin for WordPress
All versions up to and including 3.1
WordPress sites with the plugin activated and network-accessible

Discovery Timeline

2024-08-21 - CVE-2024-7390 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7390

Vulnerability Analysis

The WP Testimonial Widget plugin exposes the fnSaveTestimonailOrder function through a WordPress AJAX endpoint. The function processes ordering data submitted by clients and persists the new testimonial order to the database. The handler does not verify that the calling user holds an administrative capability such as manage_options or edit_posts. It also does not validate a nonce to ensure the request originated from an authorized workflow.

Because WordPress registers AJAX actions on both wp_ajax_ and wp_ajax_nopriv_ prefixes when configured that way, the missing capability check enables anonymous requests to alter site content. The impact is limited to integrity of the testimonial ordering rather than confidentiality or availability, which is consistent with the medium severity rating.

Root Cause

The root cause is a missing authorization check inside fnSaveTestimonailOrder in functions.php around line 358 of the plugin trunk. WordPress plugins are expected to gate state-changing operations with current_user_can() and check_ajax_referer(). Neither control is enforced here, so the function trusts any inbound request. See the WordPress Plugin Function Code for the vulnerable implementation.

Attack Vector

An attacker sends a crafted HTTP POST request to the plugin's AJAX action over the network. No credentials, tokens, or user interaction are required. The server executes the ordering update and persists the attacker-supplied sequence. Additional technical context is available in the Wordfence Vulnerability Database Entry.

No public proof-of-concept exploit is currently listed for this CVE, and it is not tracked in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-7390

Indicators of Compromise

Unexpected changes to testimonial display order on the affected WordPress site
POST requests to /wp-admin/admin-ajax.php referencing the fnSaveTestimonailOrder action from unauthenticated sessions
Database writes to the plugin's testimonial ordering table or option without a corresponding administrator login event

Detection Strategies

Inventory WordPress installations and flag any instance of WP Testimonial Widget at version 3.1 or earlier
Review web server access logs for admin-ajax.php requests whose action parameter matches the vulnerable function and lack an authenticated session cookie
Compare current testimonial order records with known-good backups to identify unauthorized modifications

Monitoring Recommendations

Enable WordPress audit logging to record plugin-triggered database writes and AJAX invocations
Forward web server and WordPress application logs to a centralized analytics platform for anomaly review
Alert on repeated unauthenticated POST requests to plugin AJAX endpoints from a single source IP address

How to Mitigate CVE-2024-7390

Immediate Actions Required

Update the WP Testimonial Widget plugin to a version later than 3.1 once the vendor publishes a fix
If no patched version is available, deactivate and remove the plugin from affected WordPress sites
Restore testimonial ordering from a trusted backup if unauthorized modification is confirmed

Patch Information

At the time of the last NVD update on 2026-06-17, the vendor advisory listings do not enumerate a specific fixed version. Administrators should consult the Wordfence Vulnerability Database Entry and the plugin repository for updates before redeploying the plugin.

Workarounds

Block unauthenticated requests to wp-admin/admin-ajax.php with the fnSaveTestimonailOrder action at the web application firewall
Restrict access to /wp-admin/ paths using IP allowlisting where administrative activity is limited to known networks
Remove or comment out the vulnerable AJAX registration in the plugin's functions.php until a fixed release is installed

bash

# Example WAF rule concept blocking anonymous access to the vulnerable action
# Adapt syntax to your WAF (ModSecurity, Cloudflare, AWS WAF, etc.)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1007390,msg:'Block CVE-2024-7390 unauth testimonial reorder'"
    SecRule ARGS:action "@streq fnSaveTestimonailOrder" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"