CVE-2024-1175
📋 TL;DR
The WP-Recall plugin for WordPress has a missing capability check that allows unauthenticated attackers to delete arbitrary payment records. This affects all WordPress sites using WP-Recall plugin versions up to and including 16.26.6. The vulnerability enables data destruction without authentication.
💻 Affected Systems
- WP-Recall – Registration, Profile, Commerce & More WordPress plugin
📦 What is this software?
Wp Recall by Plechevandrey
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of payment transaction records, financial data corruption, and potential business disruption if critical payment data is deleted.
Likely Case
Selective deletion of payment records causing accounting discrepancies, customer disputes, and operational confusion.
If Mitigated
Minimal impact if payment data is regularly backed up and the plugin is not internet-facing.
🎯 Exploit Status
The vulnerability requires no authentication and minimal technical skill to exploit via crafted HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.26.7 or later
Vendor Advisory: https://wordpress.org/plugins/wp-recall/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP-Recall plugin. 4. Click 'Update Now' if update available. 5. If no update appears, manually download version 16.26.7+ from WordPress.org and replace plugin files.
🔧 Temporary Workarounds
Disable WP-Recall Plugin
allTemporarily deactivate the vulnerable plugin until patched
wp plugin deactivate wp-recall
Restrict Access via Web Application Firewall
allBlock requests to wp-recall plugin endpoints
# WAF rule to block /wp-content/plugins/wp-recall/*
🧯 If You Can't Patch
- Implement regular database backups of payment tables
- Restrict network access to WordPress admin interface using IP whitelisting
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → WP-Recall version. If version is 16.26.6 or lower, system is vulnerable.Check Version:
wp plugin get wp-recall --field=versionVerify Fix Applied:
Confirm WP-Recall plugin version is 16.26.7 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /wp-admin/admin-ajax.php with action=delete_payment
- Unusual deletion events in payment database tables
Network Indicators:
- Unusual traffic patterns to wp-recall plugin endpoints from unauthenticated sources
SIEM Query:
source="wordpress.log" AND "action=delete_payment" AND NOT user_authenticated=true