CVE-2024-9234: GutenKit WordPress Auth Bypass Vulnerability

CVE-2024-9234 Overview

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress contains a critical arbitrary file upload vulnerability due to a missing capability check on the install_and_activate_plugin_from_external() function within the install-active-plugin REST API endpoint. This vulnerability affects all versions up to and including 2.1.0, allowing unauthenticated attackers to install and activate arbitrary plugins or upload arbitrary files disguised as plugins.

Critical Impact

Unauthenticated remote attackers can achieve complete site compromise by uploading malicious files or plugins, potentially leading to full server takeover, data theft, and persistent backdoor installation.

Affected Products

• GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin versions ≤ 2.1.0
• WordPress sites running vulnerable GutenKit plugin versions
• Any WordPress installation with the gutenkit-blocks-addon plugin installed

Discovery Timeline

• 2024-10-11 - CVE-2024-9234 published to NVD
• 2024-10-15 - Last updated in NVD database

Technical Details for CVE-2024-9234

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a critical access control flaw that allows unauthenticated users to execute privileged functionality. The vulnerable function install_and_activate_plugin_from_external() in the ActivePluginData.php file lacks proper capability checks, meaning it does not verify whether the requesting user has administrator privileges before processing plugin installation requests.

The REST API endpoint exposes plugin installation functionality to any remote user without requiring authentication. An attacker can leverage this endpoint to install malicious plugins from external sources or upload arbitrary PHP files masquerading as legitimate plugin packages. Since WordPress plugins execute PHP code with full server permissions within the WordPress context, this vulnerability provides a direct path to remote code execution.

Root Cause

The root cause of this vulnerability is the absence of a permission_callback or manual capability check within the REST API route handler for the install-active-plugin endpoint. The install_and_activate_plugin_from_external() function processes external plugin installation requests without first validating that the requester has the install_plugins or activate_plugins capabilities that WordPress requires for such operations. This missing authorization check violates the principle of least privilege and exposes administrative functionality to unauthenticated users.

Attack Vector

The attack is conducted over the network and requires no authentication or user interaction. An attacker identifies a WordPress site running a vulnerable version of the GutenKit plugin and sends a crafted HTTP request to the install-active-plugin REST API endpoint. The request includes a URL pointing to a malicious plugin package (ZIP file) hosted on an attacker-controlled server.

The vulnerable function retrieves the specified plugin package, extracts it, and activates it without performing any authorization checks. The malicious plugin can contain web shells, backdoors, or any arbitrary PHP code that will execute with full WordPress privileges once activated. This allows the attacker to:

1. Execute arbitrary commands on the server
2. Access and exfiltrate database contents including user credentials
3. Modify site content for defacement or malware distribution
4. Establish persistent access through hidden backdoor accounts
5. Pivot to attack other sites on shared hosting environments

Detection Methods for CVE-2024-9234

Indicators of Compromise

• Unexpected HTTP POST requests to /wp-json/gutenkit/v1/install-active-plugin from external IP addresses
• Newly installed or activated plugins that were not authorized by administrators
• Unknown PHP files appearing in the /wp-content/plugins/ directory
• Web shell signatures or obfuscated PHP code in recently modified plugin files
• Unusual outbound network connections from the WordPress server

Detection Strategies

• Monitor WordPress REST API logs for unauthenticated requests to GutenKit endpoints, particularly the install-active-plugin route
• Implement file integrity monitoring on the /wp-content/plugins/ directory to detect unauthorized plugin installations
• Review WordPress admin activity logs for plugin activations that don't correspond to administrator actions
• Deploy web application firewall rules to inspect and block suspicious plugin installation requests

Monitoring Recommendations

• Enable detailed logging for WordPress REST API endpoints and review logs daily for anomalous patterns
• Configure real-time alerts for new plugin installations or activations outside of maintenance windows
• Implement network-level monitoring to detect data exfiltration attempts following potential exploitation
• Regularly audit installed plugins against an approved whitelist to identify unauthorized additions

How to Mitigate CVE-2024-9234

Immediate Actions Required

• Immediately update the GutenKit plugin to version 2.1.1 or later, which contains the security fix
• Audit all installed WordPress plugins to identify any unauthorized or suspicious plugins that may have been installed via exploitation
• Review server access logs for evidence of exploitation attempts against the vulnerable endpoint
• If compromise is suspected, perform a full malware scan and consider restoring from a known-good backup

Patch Information

The vulnerability has been patched in GutenKit version 2.1.1. The fix adds proper capability checks to the install_and_activate_plugin_from_external() function, ensuring only authenticated users with appropriate administrative privileges can access the plugin installation functionality. The patched code can be reviewed in the WordPress Trac 2.1.1 Code. For additional technical details, see the Wordfence Vulnerability Report.

Workarounds

• If immediate patching is not possible, temporarily disable or delete the GutenKit plugin until it can be updated
• Implement web application firewall rules to block unauthenticated requests to the /wp-json/gutenkit/v1/install-active-plugin endpoint
• Restrict REST API access at the server level using .htaccess or nginx configuration to require authentication for GutenKit endpoints
• Consider using a WordPress security plugin to add additional authorization layers to REST API endpoints

# Example .htaccess rule to block unauthenticated access to vulnerable endpoint
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-json/gutenkit/v1/install-active-plugin
    RewriteCond %{HTTP:Authorization} ^$
    RewriteRule .* - [F,L]
</IfModule>