CVE-2024-9860: Bridge Core WordPress Auth Bypass Vulnerability

CVE-2024-9860 Overview

The Bridge Core plugin for WordPress contains a missing authorization vulnerability in versions up to and including 3.3. The flaw affects the import_action and install_plugin_per_demo functions, which lack proper capability checks. Authenticated attackers with subscriber-level permissions or higher can abuse these functions to modify or delete plugin settings, import demo data, and install a limited set of plugins. The weakness is classified under [CWE-862] (Missing Authorization) and requires only low-privilege access over the network.

Critical Impact

Any authenticated WordPress user, including subscribers, can alter plugin configuration or trigger unauthorized plugin installation, leading to data loss and site tampering.

Affected Products

• Bridge Core plugin for WordPress (bundled with the Bridge Creative Multipurpose WordPress Theme)
• All versions up to and including 3.3
• WordPress sites permitting subscriber-level registration

Discovery Timeline

• 2024-10-12 - CVE-2024-9860 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9860

Vulnerability Analysis

The Bridge Core plugin exposes two AJAX-reachable functions, import_action and install_plugin_per_demo, that perform privileged operations without validating the caller's WordPress capabilities. WordPress plugins typically gate administrative actions behind current_user_can() checks or nonce verification tied to an administrator role. Bridge Core omits these checks on the affected handlers.

An authenticated attacker holding only the subscriber role can invoke these endpoints and trigger operations reserved for site administrators. The impact includes deletion or modification of plugin settings, injection of demo content, and installation of a limited set of plugins the handler permits. See the Wordfence Vulnerability Report for additional analysis.

Root Cause

The root cause is a broken access control pattern. The affected functions execute administrative logic without calling current_user_can() to verify the requester holds a capability such as manage_options or install_plugins. Any authenticated session token satisfies the implicit authentication gate.

Attack Vector

Exploitation requires a valid WordPress account at subscriber level or above. The attacker sends a crafted HTTP request to the plugin's AJAX endpoint invoking import_action or install_plugin_per_demo. No user interaction from an administrator is required. The vulnerability is exploitable on any site that allows open user registration or where subscriber credentials have been obtained.

No verified public exploit code is available at the time of publication. Refer to the linked vendor and threat-intel advisories for further technical detail.

Detection Methods for CVE-2024-9860

Indicators of Compromise

• Unexpected POST requests to admin-ajax.php referencing the import_action or install_plugin_per_demo actions from low-privilege user sessions.
• Sudden appearance of demo content, unfamiliar pages, or reset plugin configuration on Bridge-themed sites.
• New plugins installed on the site without a corresponding administrator action in the audit log.

Detection Strategies

• Review WordPress access logs for AJAX requests to Bridge Core actions originating from accounts that do not hold administrative capabilities.
• Compare current plugin settings and installed plugin lists against a known-good baseline to identify unauthorized modifications.
• Enable and monitor a WordPress activity-logging plugin to capture role-scoped invocations of import and install operations.

Monitoring Recommendations

• Alert on any subscriber-level account issuing POST requests containing action=import_action or action=install_plugin_per_demo.
• Monitor the wp-content/plugins directory for file creation events not tied to an administrator session.
• Track new user registrations and correlate registration timestamps with subsequent plugin-related AJAX calls.

How to Mitigate CVE-2024-9860

Immediate Actions Required

• Update the Bridge Core plugin to a version later than 3.3 as soon as the vendor publishes a patched release.
• Audit WordPress user accounts and remove or downgrade unnecessary subscriber-level accounts.
• Disable open user registration on sites that do not require it by unsetting the Anyone can register option under General Settings.

Patch Information

Site administrators should obtain the latest Bridge theme and bundled Bridge Core plugin from the vendor via the ThemeForest product page. Verify the installed Bridge Core version under Plugins after updating to confirm it is above 3.3.

Workarounds

• Restrict access to wp-admin/admin-ajax.php at the web server or WAF layer for the import_action and install_plugin_per_demo action parameters until the plugin is patched.
• Temporarily deactivate the Bridge Core plugin on sites where an update is not yet available and demo import functionality is not required.
• Enforce strong authentication and rate limiting on the WordPress login endpoint to reduce the pool of usable subscriber accounts.

# Example ModSecurity rule to block the vulnerable AJAX actions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1009860,\
   msg:'Block Bridge Core vulnerable AJAX actions (CVE-2024-9860)'"
  SecRule ARGS:action "@rx ^(import_action|install_plugin_per_demo)$" "t:lowercase"