CVE-2024-13801
Published: 26 March 2025
Summary
CVE-2024-13801 is a high-severity Missing Authorization (CWE-862) vulnerability in Codecanyon (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2024-13801 is a vulnerability in the BWL Advanced FAQ Manager plugin for WordPress, affecting all versions up to and including 2.1.4. It stems from a missing capability check on the 'baf_set_notice_status' AJAX action (CWE-862), enabling unauthorized modification of data that can result in denial of service. The issue has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), highlighting high integrity and availability impacts with no confidentiality loss.
Authenticated attackers possessing Subscriber-level access or higher can exploit this vulnerability remotely with low complexity and no user interaction required. By sending crafted AJAX requests, they can update WordPress option values to '1', potentially triggering site errors that deny service to legitimate users or enabling unintended features such as registration.
Advisories and further details are available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a84201-6cd8-4528-ae7a-7fd813c8da18?source=cve and the plugin's Codecanyon page at https://codecanyon.net/item/bwl-advanced-faq-manager/5007135.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8111
Vulnerability details
The BWL Advanced FAQ Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'baf_set_notice_status' AJAX action in all versions up to, and…
more
including, 2.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to '1' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing WordPress plugin allows authenticated exploitation via crafted AJAX requests for unauthorized option modification and DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly addressing the missing capability check on the baf_set_notice_status AJAX action.
Implements least privilege to restrict Subscriber-level users from performing high-impact actions like unauthorized modification of WordPress options.
Requires timely identification, reporting, and correction of the plugin flaw enabling unauthorized data modification.