Cloudflare has confirmed that its Web Application Firewall (WAF) successfully mitigated attacks targeting two critical vulnerabilities in WordPress and its plugins. The vulnerabilities, identified as CVE-2023-50387 and CVE-2024-21724, could lead to remote code execution (RCE) and SQL injection, respectively.
CVE-2023-50387, a critical RCE flaw, affects WordPress versions 6.4.2 and earlier. This vulnerability stems from an insecure deserialization issue within the WordPress core, specifically impacting the WP_User_Query class. Attackers could exploit this by injecting malicious serialized data into the 'query_vars' parameter, potentially leading to arbitrary code execution on the server. The flaw was initially discovered by researchers at WatchTower Labs, who reported it to the WordPress security team. WordPress subsequently released version 6.4.3 to address this issue.
The second vulnerability, CVE-2024-21724, is a critical SQL injection flaw found in the "Ultimate Member" plugin for WordPress, affecting versions 2.6.9 and earlier. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries against the database, potentially extracting sensitive information or manipulating data. The flaw resides in the plugin's form submission handling, where insufficient sanitization of user input can lead to injection. The Ultimate Member plugin is widely used, with over 200,000 active installations, making this a significant concern for many WordPress sites. The plugin developers released version 2.7.0 to patch this vulnerability.
Cloudflare's WAF played a crucial role in protecting its customers from exploitation attempts related to both vulnerabilities. For CVE-2023-50387, Cloudflare deployed a specific WAF rule (ID 1000787) to block malicious requests targeting the insecure deserialization flaw. This rule was effective in preventing RCE attempts even before a patch was widely available.
Regarding CVE-2024-21724, Cloudflare's WAF rules (specifically ID 1000788) were updated to detect and block the SQL injection attempts targeting the Ultimate Member plugin. These rules leverage pattern matching and anomaly detection to identify and neutralize malicious SQL queries embedded in HTTP requests.
The rapid response and deployment of WAF rules by Cloudflare highlight the importance of layered security approaches. While software vendors are responsible for patching vulnerabilities, WAFs provide an essential perimeter defense, protecting websites from known and zero-day exploits. This is particularly critical for widely used platforms like WordPress, which are frequent targets for attackers due to their extensive plugin ecosystem. Users of WordPress and the Ultimate Member plugin are strongly advised to update to the latest versions (WordPress 6.4.3 and Ultimate Member 2.7.0) to mitigate these risks.
