CVE-2024-12614 in Passwords Manager Plugin
Summary
by MITRE • 01/16/2025
The Passwords Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pms_save_setting' and 'post_new_pass' AJAX actions in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings and add passwords.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/18/2025
The vulnerability identified as CVE-2024-12614 affects the Passwords Manager plugin for WordPress, specifically targeting versions up to and including 1.4.8. This issue represents a critical access control flaw that undermines the security posture of WordPress installations relying on this plugin. The vulnerability stems from insufficient capability validation within the plugin's AJAX handling mechanisms, creating a pathway for unauthorized data modification that directly impacts the integrity and confidentiality of stored password information.
The technical flaw manifests through two primary AJAX actions: 'pms_save_setting' and 'post_new_pass' which lack proper capability checks before executing their respective functions. This missing validation allows authenticated users with Subscriber-level privileges or higher to manipulate plugin settings and inject new password entries without proper authorization. The vulnerability operates at the application layer and specifically targets the plugin's administrative functionality, making it particularly dangerous as it bypasses standard WordPress permission models that should restrict such operations to authorized users only.
From an operational impact perspective, this vulnerability creates significant risk for organizations using the Passwords Manager plugin, as it enables low-privilege attackers to gain unauthorized access to sensitive password management features. The ability to modify plugin settings could potentially allow threat actors to disable security features, redirect password storage, or manipulate access controls within the plugin. Additionally, the capability to add new passwords provides a means for attackers to inject malicious credentials into the system, potentially leading to further compromise of user accounts and network resources. This vulnerability directly violates the principle of least privilege and undermines the trust model that WordPress relies upon for user access control.
The vulnerability aligns with CWE-285, which addresses improper authorization issues in software systems, and maps to ATT&CK technique T1078.004 which covers valid accounts for privilege escalation. Organizations should immediately update to the latest version of the Passwords Manager plugin to remediate this vulnerability, as no patches were available for the affected versions. Security monitoring should be enhanced to detect unusual AJAX activity patterns that might indicate exploitation attempts. Network segmentation and privileged access controls should be reviewed to limit the potential impact of compromised subscriber accounts. Additionally, regular security audits of WordPress plugins should be conducted to identify similar authorization flaws that could potentially affect the broader WordPress ecosystem and its users.