CVE-2024-13716
📋 TL;DR
The Forex Calculators WordPress plugin has an authorization vulnerability that allows authenticated users with Subscriber-level permissions or higher to modify plugin settings. This affects all WordPress sites using version 1.3.5 or earlier of the plugin. Attackers can change plugin configuration without proper authorization checks.
💻 Affected Systems
- Forex Calculators WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify plugin settings to inject malicious code, redirect users to phishing sites, or disrupt financial calculation functionality.
Likely Case
Attackers with subscriber accounts could alter calculator settings, change display options, or modify plugin behavior.
If Mitigated
With proper user role management and monitoring, impact is limited to unauthorized configuration changes.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once an account is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.6 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3169206%40fx-calculators&new=3169206%40fx-calculators
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find Forex Calculators plugin
4. Click 'Update Now' if available
5. Or download version 1.3.6+ from WordPress repository and replace files
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate forex-calculators
Restrict User Registration
allDisable new user registration to prevent attacker account creation
Update WordPress Settings → General → Membership: 'Anyone can register' should be unchecked
🧯 If You Can't Patch
- Remove Subscriber role from all non-essential users
- Implement web application firewall rules to block suspicious AJAX requests to the plugin
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin panel under Plugins → Installed Plugins. If version is 1.3.5 or lower, you are vulnerable.Check Version:
wp plugin get forex-calculators --field=versionVerify Fix Applied:
Verify plugin version is 1.3.6 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual AJAX requests to forex-calculators plugin endpoints from subscriber-level users
- Multiple failed authentication attempts followed by successful login and plugin setting changes
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action parameter containing 'fx_calculators' or similar plugin identifiers
SIEM Query:
source="wordpress.log" AND (uri_path="/wp-admin/admin-ajax.php" AND http_method="POST" AND user_role="subscriber" AND plugin="forex-calculators")