CVE-2024-13558
Published: 20 March 2025
Summary
CVE-2024-13558 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Neahplugins Np Quote Request For Woocommerce. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-13558 is an Insecure Direct Object Reference (IDOR) vulnerability, classified under CWE-639, affecting the NP Quote Request for WooCommerce plugin for WordPress in all versions up to and including 1.9.179. The issue stems from missing validation on a user-controlled key, which exposes the content of quote requests. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility, low attack complexity, and no privileges required.
Unauthenticated attackers can exploit this vulnerability remotely by manipulating the user-controlled key to access quote request content belonging to other users. No user interaction or privileges are needed, enabling arbitrary disclosure of sensitive quote data across the site.
WordPress plugin trac changeset 3256816 addresses the issue, with additional details available on the plugin's developers page and Wordfence threat intelligence advisory. Site operators should update the plugin beyond version 1.9.179 to mitigate the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6800
Vulnerability details
The NP Quote Request for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.179 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers…
more
to read the content of quote requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
IDOR vulnerability in public-facing WordPress plugin enables remote unauthenticated exploitation of internet-facing application for data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to quote requests, directly preventing IDOR exploitation via missing validation on user-controlled keys.
Requires validation of user-controlled inputs like the key parameter to ensure only authorized quote request content is accessed.
Mandates timely flaw remediation by updating the vulnerable NP Quote Request plugin beyond version 1.9.179 to fix the IDOR issue.