CVE-2024-43131
📋 TL;DR
This vulnerability allows unauthenticated attackers to delete arbitrary posts and pages in WordPress sites using the vulnerable Docket plugin. It affects all WordPress installations with the Docket (WooCommerce Collections/Wishlist/Watchlist) plugin before version 1.7.0.
💻 Affected Systems
- Docket (WooCommerce Collections / Wishlist / Watchlist) WordPress plugin
📦 What is this software?
Docket by Wpwebelite
Docket by Wpwebelite
⚠️ Risk & Real-World Impact
Worst Case
Complete website defacement or destruction through mass deletion of critical content, potentially causing business disruption and data loss.
Likely Case
Selective deletion of important posts, pages, or products leading to content loss and website integrity issues.
If Mitigated
No impact if plugin is patched or disabled, or if proper web application firewalls block the exploit attempts.
🎯 Exploit Status
The vulnerability requires no authentication and has publicly available technical details, making exploitation trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.0
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Docket (WooCommerce Collections/Wishlist/Watchlist)'. 4. Click 'Update Now' if update available. 5. If no update appears, manually download version 1.7.0+ from WordPress repository.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the Docket plugin until patched
wp plugin deactivate woocommerce-collections
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block unauthorized POST requests to the vulnerable endpoints
- Restrict access to the WordPress admin area using IP whitelisting or additional authentication layers
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin > Plugins > Installed Plugins for Docket plugin version. If version is below 1.7.0, you are vulnerable.Check Version:
wp plugin get woocommerce-collections --field=versionVerify Fix Applied:
Confirm plugin version is 1.7.0 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to wp-admin/admin-ajax.php with action parameters related to post/page deletion
- Unexpected post/page deletions in WordPress logs
Network Indicators:
- Unusual POST requests to admin-ajax.php from unauthenticated sources
- HTTP 200 responses to deletion requests from non-admin IPs
SIEM Query:
source="wordpress.log" AND "admin-ajax.php" AND "action=*delete*" AND NOT user="admin"