CVE-2024-13801
Published: 26 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2024-13801 is a vulnerability in the BWL Advanced FAQ Manager plugin for WordPress, affecting all versions up to and including 2.1.4. It stems from a missing capability check on the 'baf_set_notice_status' AJAX action (CWE-862), enabling unauthorized modification of data that can result in denial of service. The issue has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), highlighting high integrity and availability impacts with no confidentiality loss.
Authenticated attackers possessing Subscriber-level access or higher can exploit this vulnerability remotely with low complexity and no user interaction required. By sending crafted AJAX requests, they can update WordPress option values to '1', potentially triggering site errors that deny service to legitimate users or enabling unintended features such as registration.
Advisories and further details are available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a84201-6cd8-4528-ae7a-7fd813c8da18?source=cve and the plugin's Codecanyon page at https://codecanyon.net/item/bwl-advanced-faq-manager/5007135.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Vulnerability in public-facing WordPress plugin allows authenticated exploitation via crafted AJAX requests for unauthorized option modification and DoS.