Introduction
Attackers can gain full administrative control of a WordPress site running CE21 Suite by sending one crafted request to a public AJAX endpoint. Remote, unauthenticated users can update plugin settings and create admin accounts on any affected installation.
CE21 Suite is a single sign-on plugin for WordPress sites, developed by ce21com. It has only 30 active installs and 1,597 downloads, so it is not widely used, but it poses a significant risk to any site running a vulnerable version.
Technical Information
The vulnerability is in the way CE21 Suite handles the wp_ajax_nopriv_ce21_single_sign_on_save_api_settings AJAX action. In WordPress, AJAX actions prefixed with wp_ajax_nopriv_ are accessible to unauthenticated users. The plugin registers this action, but the handler function performs no capability or nonce checks.
When a POST request is sent to wp-admin/admin-ajax.php with the parameter action=ce21_single_sign_on_save_api_settings, the plugin processes the request and updates its API settings. These include sensitive fields such as the secret key used for authentication. Because the handler has no current_user_can() check or similar authorization logic, any remote user can modify these settings, whether authenticated or not.
This design flaw is classified as CWE-306 (Missing Authentication for Critical Function). The attack flow is straightforward:
- The attacker identifies a WordPress site running a vulnerable version of CE21 Suite.
- The attacker sends a POST request to
/wp-admin/admin-ajax.phpwithaction=ce21_single_sign_on_save_api_settingsand new API settings (including a new secret key). - The plugin updates its configuration with the attacker-supplied values.
- The attacker uses the new secret key or modified settings to create new administrator accounts or escalate privileges.
Public sources include no code snippets, but multiple advisories and threat intelligence feeds confirm the vulnerability.
Affected Systems and Versions
- Product: CE21 Suite WordPress plugin
- Affected versions: 2.2.1 to 2.3.1
- Vulnerable configuration: Any WordPress site with CE21 Suite versions 2.2.1, 2.2.2, 2.3.0, or 2.3.1 installed and active
Vendor Security History
CE21 Suite has a history of critical security issues:
- CVE-2024-10284: Authentication bypass due to hardcoded encryption key
- CVE-2024-10285: JWT token disclosure
- CVE-2024-10294: Missing authorization to unauthenticated plugin settings change
The plugin has been removed from the WordPress repository. The vendor has responded to previous vulnerabilities reactively, and there is no evidence of a proactive security process or fast patch turnaround.
