CVE-2024-32715
📋 TL;DR
This CVE describes a Missing Authorization vulnerability in the WordPress Olive One Click Demo Import plugin that allows arbitrary file download. Attackers can exploit this to download sensitive files from the server without proper authentication. WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- WordPress Olive One Click Demo Import plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through downloading sensitive configuration files (like wp-config.php) containing database credentials, followed by database takeover and potential RCE.
Likely Case
Unauthorized access to sensitive files including configuration files, user data, or backup files leading to data exposure.
If Mitigated
Limited impact if proper file permissions restrict access to sensitive files and web server runs with minimal privileges.
🎯 Exploit Status
Exploitation requires simple HTTP requests to vulnerable endpoints without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.2 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Olive One Click Demo Import'. 4. Click 'Update Now' if update available. 5. If no update, deactivate and delete plugin, then install fresh version from WordPress repository.
🔧 Temporary Workarounds
Disable vulnerable plugin
allDeactivate the Olive One Click Demo Import plugin to prevent exploitation
wp plugin deactivate olive-one-click-demo-import
Restrict plugin directory access
linuxAdd .htaccess rules to block direct access to plugin files
echo 'Deny from all' > /path/to/wp-content/plugins/olive-one-click-demo-import/.htaccess
🧯 If You Can't Patch
- Deactivate and remove the Olive One Click Demo Import plugin immediately
- Implement web application firewall rules to block requests to /wp-content/plugins/olive-one-click-demo-import/ paths
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Olive One Click Demo Import version 1.1.1 or earlierCheck Version:
wp plugin get olive-one-click-demo-import --field=versionVerify Fix Applied:
Verify plugin version is 1.1.2 or later in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /wp-content/plugins/olive-one-click-demo-import/ with file download parameters
- Multiple 200 responses for file downloads from plugin directory
Network Indicators:
- Unusual file download patterns from WordPress plugin paths
- Requests for sensitive files like wp-config.php from plugin endpoints
SIEM Query:
source="web_server" AND (uri_path="/wp-content/plugins/olive-one-click-demo-import/*" AND (status=200 OR parameters CONTAINS "file=" OR parameters CONTAINS "download="))🔗 References
- https://patchstack.com/database/vulnerability/olive-one-click-demo-import/wordpress-olive-one-click-demo-import-plugin-1-1-1-arbitrary-file-download-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/olive-one-click-demo-import/wordpress-olive-one-click-demo-import-plugin-1-1-1-arbitrary-file-download-vulnerability?_s_id=cve
