CVE-2024-9364
📋 TL;DR
The SendGrid for WordPress plugin has a missing capability check that allows authenticated users with Subscriber-level access or higher to delete the plugin's log files. This vulnerability affects all versions up to and including 1.4, potentially allowing attackers to erase audit trails and disrupt logging functionality.
💻 Affected Systems
- SendGrid for WordPress plugin
📦 What is this software?
Sendgrid by Smackcoders
⚠️ Risk & Real-World Impact
Worst Case
Attackers delete critical log files to cover tracks after other attacks, hindering forensic investigation and compliance reporting.
Likely Case
Malicious users delete plugin logs to hide their activities or disrupt administrative monitoring capabilities.
If Mitigated
Minimal impact if proper access controls and log monitoring are in place to detect unauthorized deletions.
🎯 Exploit Status
Exploitation requires authenticated WordPress user account with at least Subscriber role.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 1.4 (check plugin repository for latest)
Vendor Advisory: https://plugins.trac.wordpress.org/browser/wp-sendgrid-mailer/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'SendGrid for WordPress' plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download latest version from WordPress plugin repository and replace files.
🔧 Temporary Workarounds
Disable vulnerable function via code modification
allAdd capability check to wp_mailplus_clear_logs function in plugin code.
Edit wp-sendgrid-mailer.php file and add: if (!current_user_can('manage_options')) { wp_die('Unauthorized'); } before log deletion code.
Remove plugin temporarily
linuxDeactivate and delete vulnerable plugin until patched version available.
wp plugin deactivate wp-sendgrid-mailer
wp plugin delete wp-sendgrid-mailer
🧯 If You Can't Patch
- Restrict user roles - Remove Subscriber access or implement least privilege principles.
- Implement file integrity monitoring - Use tools like Tripwire or OSSEC to detect log file deletions.
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin panel under Plugins → Installed Plugins. If version is 1.4 or earlier, system is vulnerable.Check Version:
wp plugin get wp-sendgrid-mailer --field=versionVerify Fix Applied:
After update, verify plugin version is higher than 1.4. Test with Subscriber account attempting to access log deletion functionality.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to wp_mailplus_clear_logs endpoint
- Sudden deletion of plugin log files without admin action
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=wp_mailplus_clear_logs from non-admin users
SIEM Query:
source="wordpress.log" AND "wp_mailplus_clear_logs" AND user_role!="administrator"