CVE-2024-4661
📋 TL;DR
The WP Reset WordPress plugin has an authorization vulnerability that allows authenticated users with subscriber-level access or higher to modify the license key field for the Pro version activation. This occurs due to missing capability checks in the save_ajax function. Any WordPress site using WP Reset plugin versions up to 2.02 is affected.
💻 Affected Systems
- WP Reset WordPress Plugin
📦 What is this software?
Wp Reset by Webfactoryltd
⚠️ Risk & Real-World Impact
Worst Case
Attackers could activate unauthorized Pro licenses, potentially enabling premium features without payment or compromising plugin functionality.
Likely Case
Unauthorized users modify license settings, causing licensing validation issues or enabling paid features without proper authorization.
If Mitigated
With proper user role management and capability checks, only administrators can modify license settings as intended.
🎯 Exploit Status
Exploitation requires authenticated access to WordPress with at least subscriber privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.03 and later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3097597/wp-reset
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins > Installed Plugins
3. Find WP Reset plugin
4. Click 'Update Now' if available
5. Alternatively, download version 2.03+ from WordPress repository
6. Deactivate and delete old version
7. Upload and activate new version
🔧 Temporary Workarounds
Remove vulnerable plugin
allTemporarily disable or remove the WP Reset plugin until patched
wp plugin deactivate wp-reset
wp plugin delete wp-reset
Restrict user roles
allLimit user accounts with subscriber or higher roles to trusted individuals only
🧯 If You Can't Patch
- Remove the WP Reset plugin entirely from production systems
- Implement strict access controls and monitor for unauthorized license modification attempts
🔍 How to Verify
Check if Vulnerable:
Check WP Reset plugin version in WordPress admin panel under Plugins > Installed PluginsCheck Version:
wp plugin get wp-reset --field=versionVerify Fix Applied:
Verify WP Reset plugin version is 2.03 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual license key modification attempts in WordPress logs
- AJAX requests to save_ajax function from non-admin users
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=wp_reset_save_ajax from non-admin IPs
SIEM Query:
source="wordpress.log" AND "wp_reset_save_ajax" AND user_role!="administrator"🔗 References
- https://plugins.trac.wordpress.org/changeset/3097597/wp-reset
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0d2dc86e-f937-429f-9baa-0eb0a8715513?source=cve
- https://plugins.trac.wordpress.org/changeset/3097597/wp-reset
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0d2dc86e-f937-429f-9baa-0eb0a8715513?source=cve
