CVE-2021-24831
📋 TL;DR
The Tab WordPress plugin before version 1.3.2 exposes all AJAX actions to unauthenticated users, allowing attackers to add, edit, or delete arbitrary tabs without authentication. This affects WordPress sites running vulnerable versions of the Tab plugin.
💻 Affected Systems
- Tab WordPress plugin
📦 What is this software?
Tab by Rich Web
⚠️ Risk & Real-World Impact
Worst Case
Attackers could deface websites, inject malicious content, or delete all tab content, potentially leading to data loss and reputation damage.
Likely Case
Unauthenticated attackers modify tab content to insert malicious links, spam, or deface the site's tab sections.
If Mitigated
With proper access controls, only authenticated administrators could modify tabs, preventing unauthorized changes.
🎯 Exploit Status
Exploitation requires sending crafted AJAX requests to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.2
Vendor Advisory: https://wpscan.com/vulnerability/75ed9f5f-e091-4372-a6cb-57958ad5f900
Restart Required: No
Instructions:
1. Update Tab plugin to version 1.3.2 or later via WordPress admin panel. 2. Verify update completes successfully. 3. Test tab functionality.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable the Tab plugin until patched.
wp plugin deactivate tab
Restrict AJAX endpoints
allUse web application firewall to block unauthenticated access to /wp-admin/admin-ajax.php?action=tab_* endpoints.
🧯 If You Can't Patch
- Disable the Tab plugin entirely.
- Implement strict network access controls to limit who can reach the WordPress admin AJAX endpoints.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel for Tab plugin version. If version is below 1.3.2, it's vulnerable.Check Version:
wp plugin get tab --field=versionVerify Fix Applied:
Confirm Tab plugin version is 1.3.2 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with tab_* actions from unauthenticated IPs.
- Multiple failed authentication attempts followed by tab modification requests.
Network Indicators:
- Unusual traffic patterns to WordPress AJAX endpoints from external sources.
- Spikes in requests to admin-ajax.php with tab-related parameters.
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin-ajax.php" AND query="action=tab_*" AND user="-"