Atomic Edge analysis of CVE-2024-33567 (metadata-based):
The Barcode Scanner with Inventory & Order Manager plugin for WordPress, in versions up to and including 1.5.3, is vulnerable to unauthenticated privilege escalation. The plugin fails to properly restrict which user meta keys can be updated. An attacker with no account on the site can supply arbitrary user meta values through an exposed endpoint and set the `wp_capabilities` meta key to grant themselves administrator privileges. The CVSS score is 9.8 (Critical), reflecting network exploitability, no authentication requirement, and full compromise of confidentiality, integrity, and availability. This analysis is based solely on CVE metadata, CWE classification, and the WordPress plugin context, as no source diff is available.
Root Cause: The vulnerability maps to CWE-269 (Improper Privilege Management). Atomic Edge research infers that the plugin exposes a handler, likely a public AJAX action or REST route, that accepts a user identifier and arbitrary meta key/value pairs without validating the meta key against a safe allowlist or enforcing a capability check such as `current_user_can(‘edit_user’, $user_id)`. Because WordPress stores capabilities in the `wp_capabilities` user meta key, an attacker who can pass that key through the unvalidated update path can assign the `administrator` role. The description explicitly states the plugin does not properly restrict user meta values, which confirms the missing meta key validation. The exact endpoint name, nonce requirement, and parameter structure are inferred from typical WordPress plugin patterns and the plugin slug.
Exploitation: An unauthenticated attacker sends a crafted HTTP request to the plugin’s public endpoint, most likely `/wp-admin/admin-ajax.php` with an action parameter derived from the plugin slug (for example `barcode_scanner_lite_save_user_meta` or a similar handler). The request includes a target user ID (often `1` for the default admin or a newly created user) and a `wp_capabilities` parameter set to an array containing `administrator` set to true. In WordPress, serialized capability arrays are often accepted as `wp_capabilities[administrator]=1`. Because the handler does not verify that the caller has permission to edit that user or that the meta key is permitted, the update succeeds. The attacker then logs in with the elevated account or uses an existing session that now carries administrator capabilities. Atomic Edge notes that the precise action name and parameter names are inferred, not confirmed from code.
Remediation: The patch in version 1.5.4 must add strict validation of user meta keys, an allowlist of meta keys the plugin is permitted to update, and a capability check. The handler should call `current_user_can()` with the appropriate capability for the target user and reject any meta key outside the allowlist. WordPress provides `is_protected_meta()` to block protected keys like `wp_capabilities`. A nonce check should also be enforced on any state-changing request. Because the vulnerability is unauthenticated, the fix must ensure the endpoint is either not publicly accessible or that it enforces authentication and authorization before processing any meta update.
Impact: Successful exploitation grants the attacker full administrator access to the WordPress site. This enables arbitrary plugin and theme installation, creation of new admin users, modification of site content, theft of sensitive data from the database, and potential remote code execution through the theme or plugin editor. The CVSS vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` reflects that no user interaction or authentication is required, and the impact to confidentiality, integrity, and availability is high. Atomic Edge rates this as a critical risk for any site running the vulnerable version.
