CVE-2024-1650: Unauthorized Data Modification Vulnerability in the Categorify WordPress Plugin

In an ever-evolving digital world, security has become an essential aspect. The implementation of regular checks and updates has become increasingly necessary to prevent potential risks and vulnerabilities. A specific vulnerability, the CVE-2024-1650, has been discovered in the Categorify plugin for WordPress, a popular content management system (CMS) globally used by millions of websites. This vulnerability allows unauthorized modification of data and can potentially affect a large number of users. Anyone using the Categorify plugin up to and including version 1..7.4 should pay close attention to this issue.

By exploiting this vulnerability, attackers can achieve unauthorized access to rename categories within a WordPress website using the Categorify plugin. Although this might seem like a non-critical vulnerability, it can lead to further exploitation of the website's resources, causing unwanted harm and potential damages to the website owner.

Code Snippet

In the vulnerable versions of the plugin, the affected code can be found in the categorify.php file, specifically in the categorifyAjaxRenameCategory function as shown below:

function categorifyAjaxRenameCategory(){
  $nonce = $_POST['nonce'];
  if(!wp_verify_nonce($nonce, 'categorify-rename-category')){
    die('Busted!');
  }

  $old_name = $_POST['old_name'];
  $new_name = $_POST['new_name'];
  $category_id = $_POST['category_id'];

  // ..missing capability check here..

  $result = wp_update_term($category_id, 'category', array(
    'name' => $new_name
  ));

  if(is_wp_error($result)){
    echo "Error: " . $result->get_error_message();
  } else {
    echo "Category renamed!";
  }

  die();
}

add_action('wp_ajax_rename_category', 'categorifyAjaxRenameCategory');

As seen from the code snippet, the plugin is missing a capability check, making it possible for rogue users to rename categories. The version 1..7.4 and earlier versions of the Categorify plugin are confirmed to be affected by this vulnerability.

Exploit Details

To exploit this vulnerability, an attacker needs to send a specifically crafted HTTP POST request containing the required parameters, as explained below:

The attacker must be an authenticated WordPress user with subscriber-level access or above.

2. The attacker can make an HTTP POST request to the "admin-ajax.php" file, commonly found in the "/wp-admin" directory.
3. The request must contain the parameters "action", "nonce", "old_name", "new_name", and "category_id".
4. By including the right values for these parameters in the POST request, the attacker can rename the categories.

Original References

This vulnerability has been publicly disclosed with a proper CVE ID (CVE-2024-1650), which can be referred to on the official CVE database for further information. Details include, but are not limited to, a description of the vulnerability, affected product versions, and reference links to original vulnerability reports.

- CVE ID: CVE-2024-1650

Recommendations for Users

The first and foremost recommendation is to update the Categorify plugin to the latest version as soon as possible.

For WordPress site administrators and users who cannot update the plugin to a more recent version, they should restrict access to the plugin's settings panel, implement strong authentication, and two-factor authentication.

Users should also monitor their website for any suspicious activity or unauthorized modifications to carefully mitigate any potential damage caused by exploiting this vulnerability.

WordPress administrators should also consider conducting security audits and ensuring that all plugins and themes are updated regularly to reduce the risk of attacks resulting from vulnerabilities. This process should be considered a good practice for maintaining a secure and robust website.

Timeline

Published on: 02/27/2024 11:15:08 UTC
Last modified on: 02/27/2024 14:19:41 UTC