Cyber Posture

CVE-2024-11640

High

Published: 08 March 2025

Published
08 March 2025
Modified
11 March 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0207 84.0th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

Security Summary

CVE-2024-11640 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, affecting the VikRentCar Car Rental Management System plugin for WordPress in all versions up to and including 1.4.2. The issue stems from missing or incorrect nonce validation in the plugin's 'save' function. Published on 2025-03-08, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low complexity, and potential for significant confidentiality, integrity, and availability impacts.

Unauthenticated attackers can exploit this vulnerability by tricking a site administrator into performing an action, such as clicking a malicious link, which submits a forged request to alter plugin access privileges. Successful exploitation enables attackers with subscriber-level privileges or higher to upload arbitrary files to the affected site's server, potentially leading to remote code execution.

Mitigation details are available in advisories from Wordfence and the WordPress plugin repository. The patch is implemented in changeset 3225040, accessible at https://plugins.trac.wordpress.org/changeset/3225040/vikrentcar, and further intelligence is provided at https://www.wordfence.com/threat-intel/vulnerabilities/id/4a4c085a-1601-4c1a-ac17-0f2cf5d02489?source=cve. Security practitioners should prioritize updating the plugin beyond version 1.4.2 and educate administrators on verifying requests.

Details

CWE(s)
CWE-352

Affected Products

e4jconnect
vikrentcar
≤ 1.4.3

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
attack.mitre.org →
T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

CSRF vuln in public-facing WordPress plugin enables exploitation via malicious link to alter settings, facilitating arbitrary file upload (web shell) for RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References