CVE-2024-4390
📋 TL;DR
The Depicter WordPress plugin allows authenticated attackers with contributor-level access or higher to generate valid nonces for any WordPress action. This vulnerability enables privilege escalation by bypassing nonce-based security checks. All WordPress sites using Depicter versions up to 3.0.2 are affected.
💻 Affected Systems
- Depicter - Slider and Carousel slider by Depicter
📦 What is this software?
Depicter by Depicter
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary WordPress functions, potentially leading to complete site takeover, data theft, or malware injection.
Likely Case
Privilege escalation allowing contributors to perform administrator-only actions like plugin/theme installation, user management, or content modification.
If Mitigated
Limited impact if proper role-based access controls and additional security layers are implemented beyond nonce checks.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. The vulnerability is in a publicly accessible AJAX endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.3
Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3103357%40depicter%2Ftrunk&old=3090538%40depicter%2Ftrunk
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Depicter plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 3.0.3+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable Depicter Plugin
allTemporarily deactivate the vulnerable plugin until patched.
wp plugin deactivate depicter
Restrict Contributor Access
allRemove contributor roles from untrusted users or limit contributor capabilities.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests to vulnerable AJAX endpoints
- Monitor for suspicious nonce generation attempts and contributor-level user activity
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for Depicter version. If version is 3.0.2 or lower, you are vulnerable.Check Version:
wp plugin get depicter --field=versionVerify Fix Applied:
Verify Depicter plugin version is 3.0.3 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual AJAX requests to /wp-admin/admin-ajax.php with action=depicter_security
- Contributor users performing administrative actions
- Multiple nonce generation requests from single user
Network Indicators:
- POST requests to admin-ajax.php with depicter_security parameters
- Unusual nonce values in WordPress requests
SIEM Query:
source="wordpress.log" AND ("admin-ajax.php" AND "depicter_security")🔗 References
- https://plugins.trac.wordpress.org/browser/depicter/trunk/app/src/Controllers/Ajax/SecurityAjaxController.php#L14
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3103357%40depicter%2Ftrunk&old=3090538%40depicter%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7c3a5d-b8aa-45cb-983c-55ba7e3d72f3?source=cve
- https://plugins.trac.wordpress.org/browser/depicter/trunk/app/src/Controllers/Ajax/SecurityAjaxController.php#L14
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3103357%40depicter%2Ftrunk&old=3090538%40depicter%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7c3a5d-b8aa-45cb-983c-55ba7e3d72f3?source=cve
