CVE-2024-12614
📋 TL;DR
The Passwords Manager WordPress plugin up to version 1.4.8 lacks proper authorization checks, allowing authenticated users with Subscriber-level access or higher to modify plugin settings and add passwords without proper permissions. This vulnerability affects all WordPress sites using vulnerable versions of the plugin.
💻 Affected Systems
- Passwords Manager WordPress Plugin
📦 What is this software?
Passwords Manager by Hirewebxperts
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify password storage settings, add malicious passwords, or potentially escalate privileges to gain administrative control of the WordPress site.
Likely Case
Authenticated attackers can add unauthorized passwords to the manager and modify plugin configuration, potentially exposing stored credentials or disrupting password management functionality.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized password additions and configuration changes that can be detected and reverted.
🎯 Exploit Status
Requires authenticated access (Subscriber role or higher). Exploitation involves sending crafted AJAX requests to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 1.4.8
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3221505/passwords-manager
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Passwords Manager' plugin
4. Click 'Update Now' if available
5. If no update available, deactivate and delete plugin
6. Install latest version from WordPress repository
🔧 Temporary Workarounds
Disable vulnerable AJAX endpoints
allRemove or restrict access to the vulnerable pms_save_setting and post_new_pass AJAX actions
Add to theme's functions.php or custom plugin:
add_filter('wp_ajax_pms_save_setting', '__return_false');
add_filter('wp_ajax_post_new_pass', '__return_false');
🧯 If You Can't Patch
- Deactivate and remove the Passwords Manager plugin immediately
- Implement strict access controls and monitor for unauthorized AJAX requests to vulnerable endpoints
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for Passwords Manager version 1.4.8 or earlierCheck Version:
wp plugin list --name=passwords-manager --field=versionVerify Fix Applied:
Verify plugin version is higher than 1.4.8 and test AJAX endpoints with Subscriber-level account📡 Detection & Monitoring
Log Indicators:
- Unusual AJAX requests to /wp-admin/admin-ajax.php with actions pms_save_setting or post_new_pass from non-admin users
- Multiple failed authorization attempts on plugin endpoints
Network Indicators:
- POST requests to admin-ajax.php with vulnerable action parameters from unexpected user roles
SIEM Query:
source="wordpress.log" AND (action="pms_save_setting" OR action="post_new_pass") AND user_role!="administrator"🔗 References
- https://plugins.trac.wordpress.org/changeset/3221505/passwords-manager/trunk/include/pms-passwords-ajax-action.php
- https://plugins.trac.wordpress.org/changeset/3221505/passwords-manager/trunk/include/pms-settings-ajax-action.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/898c5554-fd02-47a2-a1f9-1c488cfab57e?source=cve
