CVE-2024-8195: Permalink Manager Lite Auth Bypass Vulnerability

CVE-2024-8195 Overview

CVE-2024-8195 is a missing authorization vulnerability in the Permalink Manager Lite plugin for WordPress. The flaw affects all versions up to and including 2.4.4. The plugin fails to enforce capability checks on the debug_data, debug_query, and debug_redirect functions in permalink-manager-debug.php. Unauthenticated attackers can invoke these debug endpoints to extract sensitive data, including the password, title, and content of password-protected posts. The issue is categorized under [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated network attackers can disclose password-protected post content, titles, and passwords on any WordPress site running the vulnerable plugin.

Affected Products

Permalink Manager Lite plugin for WordPress, all versions up to and including 2.4.4
WordPress sites with the plugin installed and activated
Sites relying on WordPress password-protected posts for confidentiality

Discovery Timeline

2024-08-28 - CVE-2024-8195 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8195

Vulnerability Analysis

The Permalink Manager Lite plugin ships with an internal debug script located at includes/core/permalink-manager-debug.php. This script exposes three helper functions: debug_data, debug_query, and debug_redirect. These functions return internal plugin state, resolved query details, and redirect information for arbitrary URIs.

Because the functions omit a current_user_can() capability check and lack a nonce validation step, WordPress accepts requests from any visitor. The debug output includes attributes of the resolved post object, which the plugin serializes without filtering out password-protected content or the post_password field.

An attacker who knows or guesses the URL of a private or password-protected post can trigger the debug routines and receive the underlying post record. This defeats the confidentiality control provided by WordPress post passwords. See the WordPress Plugin Debug Script source for the affected code path.

Root Cause

The root cause is missing authorization on privileged debugging entry points. Debug helpers were designed for administrator troubleshooting but were reachable from unauthenticated request contexts. No capability gate, nonce, or referer check restricted access.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker issues an HTTP request that triggers the debug functions against a target post identifier or URI. The server responds with structured post data that includes the plaintext post password and body content. No user interaction or authentication is required.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-8195

Indicators of Compromise

Unauthenticated HTTP requests containing query parameters that invoke debug_data, debug_query, or debug_redirect.
Web server access logs showing repeated requests to plugin debug endpoints from a single external IP.
Response payloads containing serialized post objects with post_password fields returned over unauthenticated sessions.

Detection Strategies

Inventory WordPress installations and flag any deployment running Permalink Manager Lite at version 2.4.4 or earlier.
Inspect web server and WAF logs for request patterns targeting permalink-manager-debug.php behavior or unusual query parameters associated with the plugin.
Correlate spikes in requests to password-protected post URLs with anomalous plugin activity.

Monitoring Recommendations

Enable verbose logging on the WordPress front controller and forward access logs to a centralized analytics platform for anomaly review.
Alert on unauthenticated requests that return unusually large response bodies from plugin endpoints.
Track outbound scraping patterns that iterate over post IDs sequentially.

How to Mitigate CVE-2024-8195

Immediate Actions Required

Upgrade Permalink Manager Lite to a version later than 2.4.4 that includes the fix from WordPress Changeset #3142479.
If patching is delayed, deactivate the Permalink Manager Lite plugin until the upgrade completes.
Rotate any post passwords that were in use while a vulnerable version was exposed to the internet.

Patch Information

The vendor addressed the issue in the commit tracked as WordPress Changeset #3142479. The patch adds capability enforcement to the debug functions so that only authorized administrators can invoke them. Site owners should update through the WordPress plugin repository.

Workarounds

Restrict access to the site with an authenticating reverse proxy or IP allowlist while the update is deployed.
Configure a web application firewall rule to block unauthenticated requests that reference the plugin debug parameters.
Temporarily remove or rename includes/core/permalink-manager-debug.php on managed hosts where an immediate upgrade is not feasible.

bash

# Example WAF rule fragment to block unauthenticated debug parameter access
SecRule ARGS_NAMES "@rx (debug_data|debug_query|debug_redirect)" \
    "id:1008195,phase:1,deny,status:403,\
     msg:'Block Permalink Manager Lite debug access (CVE-2024-8195)'"