CVE-2024-12559
📋 TL;DR
The ClickDesigns WordPress plugin has an authentication bypass vulnerability that allows unauthenticated attackers to modify or delete the plugin's API key. This affects all WordPress sites running ClickDesigns plugin versions 1.8.0 and earlier. Attackers can exploit this without any authentication or special privileges.
💻 Affected Systems
- ClickDesigns WordPress Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could disrupt plugin functionality by removing API keys, potentially causing service disruption or enabling further attacks if API keys are used for sensitive operations.
Likely Case
Attackers modify or delete API keys, disrupting the ClickDesigns integration and requiring administrators to reconfigure the plugin.
If Mitigated
Minimal impact if plugin functionality is non-critical or if API key changes are quickly detected and restored.
🎯 Exploit Status
Exploitation requires sending crafted AJAX requests to vulnerable endpoints without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.1 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3158478/clickdesigns/tags/1.8.1/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find ClickDesigns plugin
4. Click 'Update Now' if update available
5. Alternatively, download version 1.8.1+ from WordPress repository and manually update
🔧 Temporary Workarounds
Disable vulnerable AJAX endpoints
allBlock access to the vulnerable clickdesigns_add_api and clickdesigns_remove_api AJAX endpoints
# Add to .htaccess for Apache:
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$
RewriteCond %{QUERY_STRING} action=(clickdesigns_add_api|clickdesigns_remove_api)
RewriteRule ^ - [F,L]
# Add to nginx config:
location ~* /wp-admin/admin-ajax\.php$ {
if ($args ~* "action=(clickdesigns_add_api|clickdesigns_remove_api)") {
return 403;
}
}
🧯 If You Can't Patch
- Deactivate and remove the ClickDesigns plugin if not essential
- Implement web application firewall rules to block requests to vulnerable AJAX endpoints
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for ClickDesigns version. If version is 1.8.0 or lower, you are vulnerable.Check Version:
# WordPress CLI:
wp plugin list --name=clickdesigns --field=version
# Or check file directly:
grep "Version:" /path/to/wp-content/plugins/clickdesigns/clickdesigns.phpVerify Fix Applied:
After updating, verify ClickDesigns plugin version shows 1.8.1 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=clickdesigns_add_api or action=clickdesigns_remove_api from unauthenticated users
- Failed authentication attempts followed by API modification requests
Network Indicators:
- Unusual spikes in requests to WordPress AJAX endpoints from external IPs
- Requests to admin-ajax.php with clickdesigns API actions without authentication headers
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin-ajax.php" AND (query="action=clickdesigns_add_api" OR query="action=clickdesigns_remove_api") AND NOT (user_agent="WordPress/*" OR user="authenticated")🔗 References
- https://plugins.trac.wordpress.org/browser/clickdesigns/tags/1.8.0/includes/clickdesigns-ajax.php#L64
- https://plugins.trac.wordpress.org/browser/clickdesigns/tags/1.8.0/includes/clickdesigns-ajax.php#L79
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d19968-dbd8-4433-99a7-b973a59c4653?source=cve
