CVE-2024-32786 – This CVE describes an authentication bypass vul... (How to Fix)

Q: What is the severity of CVE-2024-32786?

CVE-2024-32786 has a CVSS score of 5.3 (MEDIUM). This CVE describes an authentication bypass vulnerability in the Royal Elementor Addons WordPress plugin that allows attackers to spoof IP addresses and bypass intended functionality restrictions. It affects all WordPress sites using Royal Elementor Addons versions up to 1.3.93. Attackers can exploit this to access restricted features without proper authentication.

📋 TL;DR

This CVE describes an authentication bypass vulnerability in the Royal Elementor Addons WordPress plugin that allows attackers to spoof IP addresses and bypass intended functionality restrictions. It affects all WordPress sites using Royal Elementor Addons versions up to 1.3.93. Attackers can exploit this to access restricted features without proper authentication.

💻 Affected Systems

Products:

Royal Elementor Addons and Templates (WordPress plugin)

Versions: All versions up to and including 1.3.93

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects WordPress installations with the Royal Elementor Addons plugin installed and activated.

📦 What is this software?

Royal Elementor Addons by Royal Elementor Addons

View all CVEs affecting Royal Elementor Addons →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could gain unauthorized access to administrative features, modify site content, or access sensitive data by bypassing IP-based restrictions.

🟠

Likely Case

Attackers bypass IP-based access controls to view or use functionality intended only for specific IP addresses, potentially accessing restricted content or features.

🟢

If Mitigated

With proper network segmentation and additional authentication layers, impact is limited to the specific bypassed functionality.

🌐 Internet-Facing: HIGH - WordPress sites are typically internet-facing, and this vulnerability allows unauthenticated IP spoofing attacks.

🏢 Internal Only: MEDIUM - Internal systems could still be vulnerable if attackers gain network access, but attack surface is reduced.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability involves IP spoofing which is relatively straightforward to execute with basic networking knowledge.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.3.94 or later

Vendor Advisory: https://patchstack.com/database/vulnerability/royal-elementor-addons/wordpress-royal-elementor-addons-and-templates-plugin-1-3-93-ip-bypass-vulnerability

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find 'Royal Elementor Addons and Templates'. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 1.3.94+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate Royal Elementor Addons plugin until patched

wp plugin deactivate royal-elementor-addons

Implement web application firewall rules

all

Block suspicious IP spoofing attempts at WAF level

🧯 If You Can't Patch

Implement additional authentication layers for IP-restricted functionality
Monitor logs for unusual IP address patterns or unauthorized access attempts

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Royal Elementor Addons version. If version is 1.3.93 or lower, system is vulnerable.

Check Version:

wp plugin get royal-elementor-addons --field=version

Verify Fix Applied:

Verify plugin version is 1.3.94 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Multiple failed authentication attempts from spoofed IPs
Access to restricted endpoints from unexpected IP ranges

Network Indicators:

HTTP requests with spoofed X-Forwarded-For headers
Unusual IP address patterns in web server logs

SIEM Query:

source="web_server" AND (uri_path="/wp-admin/admin-ajax.php" OR uri_path CONTAINS "royal-elementor") AND (src_ip NOT IN allowed_ips)

📊 Metadata

CVE ID: CVE-2024-32786

CVSS v3 Score: 5.3 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE: CWE-290

Published: May 17, 2024

Last Updated: March 10, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-32786, you might also want to check these: