CVE-2024-10574
Published: 26 January 2025
Summary
CVE-2024-10574 is a high-severity Missing Authorization (CWE-862) vulnerability in Ays Pro (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-10574 is a vulnerability in the Quiz Maker Business, Developer, and Agency plugins for WordPress, stemming from a missing capability check on the 'ays_save_google_credentials' function. It affects all versions up to and including 8.8.0 for Business, 21.8.0 for Developer, and 31.8.0 for Agency. The flaw enables unauthorized modification of data, specifically allowing attackers to alter Google Sheets integration credentials in the plugin's settings. Additionally, the 'client_id' parameter lacks sanitization or escaping when output, enabling cross-site scripting (XSS) via arbitrary web script injection. The issue is classified under CWE-862 (Missing Authorization) with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required, achieving a scope change due to its impact on confidentiality and integrity. By targeting the 'ays_save_google_credentials' endpoint, attackers can overwrite Google credentials, potentially disrupting integrations or enabling unauthorized access to linked services. Leveraging the unsanitized 'client_id', they can inject scripts that execute on any page displaying the tampered credentials, leading to session hijacking, data theft, or further site compromise for visiting users.
Vendor advisories, including the Quiz Maker changelog at ays-pro.com/changelog-for-quiz-maker-pro and product page at ays-pro.com/wordpress/quiz-maker, detail the issue, while Wordfence's threat intelligence at wordfence.com/threat-intel/vulnerabilities/id/d8a4feb3-908f-4fff-84f2-099f56d46f5b provides analysis. Mitigation requires updating to patched versions beyond the affected releases, as the vulnerability persists in all listed versions up to the specified endpoints.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-32878
Vulnerability details
The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ays_save_google_credentials' function in all versions up to, and including, 8.8.0 (Business), up to, and including,…
more
21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This makes it possible for unauthenticated attackers to modify the Google Sheets integration credentials within the plugin's settings. Because the 'client_id' parameter is not sanitized or escaped when used in output, this vulnerability could also be leveraged to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization on public WP plugin endpoint directly enables remote exploitation (T1190); unsanitized client_id output enables stored XSS for session hijacking (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations to prevent unauthorized modification of Google Sheets credentials due to the missing capability check.
Validates inputs like the client_id parameter to block injection of arbitrary web scripts during credential updates.
Filters output of unsanitized client_id to prevent XSS execution on pages displaying tampered credentials.