CVE-2024-9061: WP Popup Builder RCE Vulnerability

CVE-2024-9061 Overview

CVE-2024-9061 is a critical arbitrary shortcode execution vulnerability affecting the WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress. The vulnerability exists in the wp_ajax_nopriv_shortcode_Api_Add AJAX action in all versions up to and including 1.3.5, allowing unauthenticated attackers to execute arbitrary shortcodes due to improper validation before running do_shortcode.

This vulnerability is classified as Code Injection (CWE-94), where the software allows users to execute an action that does not properly validate input values. The lack of authorization checks enables remote attackers to exploit this flaw without any authentication, potentially leading to complete site compromise.

Critical Impact

Unauthenticated attackers can execute arbitrary shortcodes on vulnerable WordPress installations, potentially leading to remote code execution, data theft, or complete site takeover depending on other installed plugins and shortcodes available on the system.

Affected Products

• ThemeHunk WP Popup Builder versions up to and including 1.3.5
• WordPress sites running vulnerable versions of WP Popup Builder plugin
• All WordPress installations using WP Popup Builder without proper authorization controls

Discovery Timeline

• October 16, 2024 - CVE-2024-9061 published to NVD
• October 30, 2024 - Last updated in NVD database

Technical Details for CVE-2024-9061

Vulnerability Analysis

The WP Popup Builder plugin exposes an AJAX action handler wp_ajax_nopriv_shortcode_Api_Add that processes requests without proper authorization. The nopriv suffix in the action name indicates this endpoint is accessible to unauthenticated users, which is the root of the security issue.

When a request is made to this endpoint, the plugin fails to validate or sanitize user-supplied input before passing it to WordPress's do_shortcode() function. This function is designed to parse and execute shortcode tags embedded in content, but when exposed to untrusted input, it becomes a powerful attack vector.

The vulnerability allows attackers to invoke any registered shortcode on the WordPress installation. The impact severity depends heavily on what other plugins are installed, as many plugins register shortcodes that can perform privileged operations such as creating users, modifying database entries, or executing PHP code.

Version 1.3.5 introduced a partial fix using nonce verification, which prevented direct exploitation by requiring a valid nonce token. However, this was insufficient as nonces in WordPress are primarily designed to prevent CSRF attacks, not to serve as authorization controls. Version 1.3.6 implements proper authorization checks to fully remediate the vulnerability.

Root Cause

The root cause is improper access control and missing input validation in the AJAX handler. The plugin registered the shortcode_Api_Add action using wp_ajax_nopriv_, making it accessible to unauthenticated users. Combined with the direct pass-through of user input to do_shortcode() without sanitization or validation, this creates an arbitrary shortcode execution vulnerability.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can send a crafted HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to shortcode_Api_Add along with malicious shortcode content. The server processes this request and executes the specified shortcode with the privileges of the web application.

The attack can be automated and scaled easily, as no prior knowledge of the target installation is required beyond confirming the vulnerable plugin version is present. Attackers can leverage this to chain with other shortcodes from installed plugins to achieve various malicious objectives including but not limited to information disclosure, privilege escalation, or remote code execution.

Detection Methods for CVE-2024-9061

Indicators of Compromise

• Unexpected POST requests to /wp-admin/admin-ajax.php with action=shortcode_Api_Add parameter
• Unusual shortcode execution patterns in WordPress logs or application logs
• Unauthorized changes to site content, user accounts, or database entries
• Web server access logs showing repeated AJAX requests from unfamiliar IP addresses

Detection Strategies

• Monitor HTTP request logs for POST requests targeting admin-ajax.php with suspicious action parameters
• Implement Web Application Firewall (WAF) rules to detect and block requests containing shortcode_Api_Add action from unauthenticated sources
• Review WordPress audit logs for unexpected shortcode executions or plugin activities
• Deploy intrusion detection signatures targeting this specific AJAX action pattern

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests and review periodically
• Configure alerting for high volumes of requests to admin-ajax.php from single IP addresses
• Monitor for file system changes in WordPress directories that could indicate post-exploitation activity
• Implement real-time monitoring of user creation events and permission changes

How to Mitigate CVE-2024-9061

Immediate Actions Required

• Update WP Popup Builder plugin to version 1.3.6 or later immediately
• Review WordPress user accounts for any unauthorized additions or privilege escalations
• Audit site content and database for signs of tampering or malicious modifications
• Consider temporarily disabling the plugin if immediate update is not possible

Patch Information

ThemeHunk has released version 1.3.6 of the WP Popup Builder plugin which includes proper authorization checks to prevent unauthorized access to the vulnerable AJAX endpoint. The patch implements capability checks to ensure only authorized users can execute the shortcode API functionality.

The changeset can be reviewed at the WordPress Plugin Update. Additional technical details are available in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the WP Popup Builder plugin until it can be updated
• Implement WAF rules to block requests to admin-ajax.php containing the shortcode_Api_Add action parameter
• Restrict access to admin-ajax.php at the web server level for non-authenticated users where feasible
• Use security plugins to add additional authorization layers to AJAX endpoints

# Apache .htaccess rule to block the vulnerable endpoint (temporary workaround)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$ [NC]
    RewriteCond %{QUERY_STRING} action=shortcode_Api_Add [NC,OR]
    RewriteCond %{HTTP:X-Requested-With} ^$ [NC]
    RewriteRule .* - [F,L]
</IfModule>