CVE-2024-10124
Published: 12 December 2024
Summary
CVE-2024-10124 is a critical-severity Improper Access Control (CWE-284) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin is affected by CVE-2024-10124, an authorization bypass that permits unauthorized arbitrary plugin installation and activation. The flaw stems from a missing capability check on the tp_install() function and impacts all versions through 1.1.1, carrying a CVSS 3.1 score of 9.8.
Unauthenticated attackers reachable over the network can invoke the unprotected function to install and activate any plugin hosted on the WordPress repository. Successful exploitation can be chained with a second vulnerable plugin to obtain remote code execution on the underlying WordPress site.
The referenced WordPress plugin trac changesets show that the issue received a partial fix in version 1.1.1 and a more complete remediation in 1.2.0; site administrators should update immediately to a release containing the corrected app.php and class-installation.php files. The associated EPSS score has remained at its peak value of 0.8794 since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33487
Vulnerability details
The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tp_install() function in all versions up to, and including, 1.1.1.…
more
This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. This vulnerability was partially patched in version 1.1.1.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
The access control policy and procedures directly mandate and enforce proper access control mechanisms across the organization.
Device lock enforces restricted access until re-authentication, directly reducing unauthorized use of active sessions.
Supervision and review of access control activities directly detects and remediates improper access configurations or usages.
Explicitly identifying and documenting actions permitted without identification or authentication enforces proper access control boundaries by defining justified exceptions.
By automatically labeling outputs with security attributes, the control supports attribute-based enforcement and reduces exploitability of improper access control weaknesses.
Associating and retaining security attributes with data directly supports enforcement of access control decisions across storage, processing, and transmission.
Requiring prior authorization for each remote access type prevents improper access control over remote connections.
Requiring authorization of wireless access before allowing connections enforces proper access control for this access method.