Industrial <= 1.7.8 - Ontbrekende Autorisatie voor Geverifieerde (Abonnee+) Willekeurige Optie-update

The core impact of CVE-2024-13376 lies in the ability of a seemingly low-privilege user to gain administrative access to a WordPress site. An attacker, already logged in with a subscriber account, can exploit the missing capability check in the ajaxgettotalcontentimportitems() function to update WordPress options. A particularly concerning scenario involves modifying the default role for new user registrations to 'administrator'. This would allow the attacker to create new administrator accounts at will, effectively compromising the entire site. The blast radius extends to all data and functionality accessible by an administrator, including sensitive user information, financial data, and critical configuration settings. While no direct precedent is immediately obvious, the potential for widespread compromise mirrors the impact of other privilege escalation vulnerabilities in WordPress plugins and themes.

WordPress sites utilizing the Industrial theme, particularly those with subscriber-level users enabled and lacking robust role-based access controls, are at risk. Shared hosting environments where multiple WordPress installations share the same server resources are also vulnerable, as a compromise of one site could potentially impact others.

• wordpress / composer / npm:

grep -r '_ajax_get_total_content_import_items()' /var/www/html/wp-content/themes/industrial/

• wordpress / composer / npm:

wp plugin list --status=all | grep industrial

• wordpress / composer / npm:

wp theme list --status=all | grep industrial

1. 2025-03-14Disclosure

   disclosure

1. Gereserveerd2025-01-13
2. Gepubliceerd2025-03-14
3. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-13376 is to upgrade the Industrial WordPress theme to a patched version. As a temporary workaround, consider restricting access to the ajaxgettotalcontentimportitems() endpoint using a WordPress security plugin or custom code. Implement stricter role-based access control (RBAC) policies within WordPress to limit the privileges of subscriber accounts. Regularly review WordPress user roles and permissions to ensure they align with the principle of least privilege. After upgrading the theme, verify the fix by attempting to access the vulnerable endpoint with a subscriber account and confirming that the action is denied.