CVE-2021-24892
📋 TL;DR
This CVE describes an Insecure Direct Object Reference vulnerability in the Advanced Forms WordPress plugin that allows authenticated attackers to change arbitrary users' email addresses and request password resets. Attackers can exploit this to take over administrator accounts. The vulnerability affects both free and pro versions of the plugin before 1.6.9.
💻 Affected Systems
- Advanced Forms (Free)
- Advanced Forms (Pro)
📦 What is this software?
Advanced Forms by Advanced Forms Project
Advanced Forms by Advanced Forms Project
⚠️ Risk & Real-World Impact
Worst Case
Complete WordPress site compromise through administrator account takeover, leading to data theft, defacement, or malware installation.
Likely Case
Privilege escalation allowing attackers to gain administrative access and modify site content or user data.
If Mitigated
Limited impact if proper access controls and monitoring are in place, with potential detection of unauthorized email changes.
🎯 Exploit Status
Exploitation requires attacker to register as a WordPress user first, then use authenticated access to exploit the vulnerable edit function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.9
Vendor Advisory: https://github.com/advancedforms/advanced-forms/commit/2ce3ab6985c3a909eefb01c562995bc6a994d3a2
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Advanced Forms plugin. 4. Click 'Update Now' if update available. 5. If manual update needed, download version 1.6.9 from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Disable user registration
allPrevents attackers from obtaining initial authenticated access required for exploitation
Navigate to WordPress Settings > General > Membership: Uncheck 'Anyone can register'
Disable Advanced Forms plugin
allTemporarily remove vulnerable component until patching is possible
Navigate to WordPress Plugins > Installed Plugins > Advanced Forms > Deactivate
🧯 If You Can't Patch
- Implement strict access controls and monitor for unauthorized email changes
- Restrict user registration to trusted sources only and implement multi-factor authentication
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Advanced Forms > Version. If version is below 1.6.9, system is vulnerable.Check Version:
wp plugin list --name=advanced-forms --field=versionVerify Fix Applied:
Confirm Advanced Forms plugin version is 1.6.9 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple email change requests for different users from same account
- Password reset requests for administrator accounts from non-admin users
- User role changes in WordPress logs
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=af_save_user
- Unusual user registration patterns followed by email modification requests
SIEM Query:
source="wordpress" (event="user_email_changed" OR event="password_reset_requested") | stats count by user_id, target_user🔗 References
- https://github.com/advancedforms/advanced-forms/commit/2ce3ab6985c3a909eefb01c562995bc6a994d3a2
- https://wpscan.com/vulnerability/364b0843-a990-4204-848a-60c928cc5bc0
- https://github.com/advancedforms/advanced-forms/commit/2ce3ab6985c3a909eefb01c562995bc6a994d3a2
- https://wpscan.com/vulnerability/364b0843-a990-4204-848a-60c928cc5bc0
