CVE-2024-9189: WPFactory EU/UK VAT Manager Auth Bypass

CVE-2024-9189 Overview

CVE-2024-9189 affects the EU/UK VAT Manager for WooCommerce plugin for WordPress developed by WPFactory. The vulnerability exists in the alg_wc_eu_vat_exempt_vat_from_admin() function, which lacks a proper capability check. All plugin versions up to and including 2.12.12 are affected. Unauthenticated attackers can invoke the vulnerable AJAX endpoint to modify the VAT status of any WooCommerce order. The issue is classified under CWE-862: Missing Authorization and impacts data integrity for stores relying on the plugin to manage EU and UK VAT compliance.

Critical Impact
Unauthenticated attackers can alter the VAT-exempt status of arbitrary WooCommerce orders, undermining tax accuracy and financial reporting.

Affected Products

WPFactory EU/UK VAT Manager for WooCommerce plugin for WordPress
All versions up to and including 2.12.12
WooCommerce stores serving EU/UK customers that rely on this plugin for VAT handling

Discovery Timeline

2024-09-28 - CVE-2024-9189 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9189

Vulnerability Analysis

The plugin registers the alg_wc_eu_vat_exempt_vat_from_admin() handler through WordPress AJAX actions. The handler updates the VAT-exempt state for a given order but never validates that the request originates from a privileged user. WordPress exposes AJAX actions to both authenticated and unauthenticated visitors when hooks are registered under wp_ajax_nopriv_, allowing any web client to reach the handler over the network.

Because the function accepts order identifiers directly from the request, an attacker can iterate through order IDs and toggle VAT status at scale. The impact is limited to data integrity for order VAT flags, which aligns with the low integrity rating in the CVSS vector. Confidentiality and availability are not directly affected, but downstream financial records, invoicing, and tax filings may be corrupted.

Root Cause

The root cause is a missing capability check in the AJAX endpoint. The handler does not call current_user_can() against an administrative capability such as manage_woocommerce, and it does not verify a nonce with check_ajax_referer(). Without these controls, WordPress treats any request to the endpoint as authorized, breaking the plugin's intended access model.

Attack Vector

Exploitation requires only network access to the WordPress site's admin-ajax.php endpoint. An attacker sends a crafted POST request specifying the plugin action name and a target order ID. The plugin executes the state change without validating the requester. No user interaction, prior authentication, or elevated privileges are required. Full technical context is available in the Wordfence Vulnerability Report and the affected AJAX source file.

No verified proof-of-concept code is available. The vulnerability is described in prose based on the vendor changeset and third-party advisories.

Detection Methods for CVE-2024-9189

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php containing the alg_wc_eu_vat_exempt_vat_from_admin action name from unauthenticated sessions.
WooCommerce orders whose VAT-exempt flag changed without a corresponding administrator login event or order note.
Discrepancies between recorded VAT status and the customer's billing country in exported tax reports.

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php referencing the vulnerable action, especially from IPs without prior authenticated activity.
Correlate WooCommerce order audit trails with WordPress user session logs to identify state changes made outside of authenticated admin sessions.
Enable WordPress plugin activity logging to record VAT status changes with request metadata for retrospective analysis.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform and alert on repeated invocations of the affected AJAX action.
Baseline the normal rate of VAT status changes per day and alert when the rate deviates significantly.
Monitor outbound traffic from the web host for scripted enumeration patterns that iterate order IDs sequentially.

How to Mitigate CVE-2024-9189

Immediate Actions Required

Update the EU/UK VAT Manager for WooCommerce plugin to a version later than 2.12.12 that includes the fix from changeset 3158296.
Audit recent WooCommerce orders for unexpected VAT-exempt status changes and reconcile against tax filings.
Rotate any WordPress administrator credentials if suspicious modifications are found.

Patch Information

The vendor addressed the missing capability check in the WordPress plugin repository under changeset 3158296. Site administrators should apply the update through the WordPress plugin manager or by installing the latest release directly from the WordPress plugin repository.

Workarounds

Restrict access to /wp-admin/admin-ajax.php for the vulnerable action at the web application firewall by blocking requests containing action=alg_wc_eu_vat_exempt_vat_from_admin from unauthenticated clients.
Temporarily deactivate the plugin if patching is not immediately possible and VAT management can be paused.
Enforce IP allow-listing on the WordPress admin surface to reduce the exposure of AJAX handlers to arbitrary internet clients.

bash

# Example ModSecurity rule to block unauthenticated calls to the vulnerable action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1009189,msg:'Block CVE-2024-9189 VAT AJAX abuse'"
  SecRule ARGS:action "@streq alg_wc_eu_vat_exempt_vat_from_admin" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"