CVE-2024-37450

Executive Summary

CVE-2024-37450 is a Cross-Site Request Forgery (CSRF) vulnerability in the Benevolent WordPress theme developed by Rarathemes. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying theme settings or injecting malicious content, without their consent. The vulnerability affects all versions of the theme up to and including 1.3.4. As of this report, no official patch has been released, and the vendor’s patch status remains unknown. The CVSS score is 4.3 (Medium), with a low EPSS probability of 0.0%, indicating limited active exploitation in the wild. However, given the widespread use of WordPress themes, this vulnerability poses a significant risk to site integrity if exploited in a social engineering campaign.

Supply Chain & Package Security

This vulnerability resides in a WordPress theme, which is part of the broader WordPress ecosystem. WordPress themes are distributed via the official WordPress repository, third-party marketplaces, or direct vendor downloads. Since the vendor (Rarathemes) has not provided a patch, users must rely on manual mitigation or consider replacing the theme. The lack of a patch increases supply chain risk, as site administrators may unknowingly continue using a vulnerable theme, exposing their sites to CSRF attacks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need prior authentication.
• User Interaction: Required (UI:R) – The victim must click a malicious link or visit a crafted page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data is directly exposed.
• Integrity Impact: Low (I:L) – An attacker can modify theme settings or inject content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the requirement for user interaction reduces the immediate risk. However, in a targeted phishing campaign, an attacker could leverage this CSRF to deface a site, inject malicious scripts, or alter configuration, leading to further compromise.

Deep Dive & Mechanics

The vulnerability stems from a lack of CSRF protection in the Benevolent theme’s administrative functions. WordPress themes typically include settings pages (e.g., in the Customizer or Theme Options) that allow administrators to modify site appearance and behavior. In this case, the theme fails to implement a nonce or token verification for state-changing requests, such as saving theme options or importing/exporting settings.

Attack Flow:

1. The attacker crafts a malicious HTML page or email containing a forged request (e.g., a form submission or image tag) that targets the vulnerable endpoint.
2. The victim, who is authenticated as an administrator on the WordPress site, visits the attacker’s page.
3. The victim’s browser automatically sends the forged request, including their session cookies, to the WordPress site.
4. The server processes the request without verifying its origin, leading to an unintended action (e.g., changing the site title, enabling a malicious plugin, or injecting JavaScript).

Root Cause: The theme’s admin-ajax.php handlers or settings pages do not check for a CSRF nonce. This is a common oversight in theme development, where developers rely on WordPress’s built-in CSRF mechanisms but fail to implement them in custom endpoints.

Vulnerable vs. Patched Code

Since no official patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (Example from Benevolent theme):

// In functions.php or admin page
function benevolent_save_settings() {
    // No nonce check
    update_option('benevolent_theme_options', $_POST['options']);
}
add_action('wp_ajax_benevolent_save_settings', 'benevolent_save_settings');

Patched Code (Expected fix):

function benevolent_save_settings() {
    // Verify nonce
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'benevolent_save_settings' ) ) {
        wp_die( 'CSRF validation failed.' );
    }
    update_option('benevolent_theme_options', $_POST['options']);
}
add_action('wp_ajax_benevolent_save_settings', 'benevolent_save_settings');

The patch adds a nonce check using wp_verify_nonce(), which ensures the request originated from the legitimate admin interface.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site running Benevolent theme version <= 1.3.4.
• An authenticated administrator session (the victim must be logged in).

Exploit Steps:

1. Identify the vulnerable endpoint. For example, the theme might have an AJAX action like benevolent_save_settings or a direct POST to /wp-admin/admin-ajax.php?action=benevolent_save_settings.
2. Craft a malicious HTML page that submits a forged request. Below is an example that changes the site title:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="benevolent_save_settings">
    <input type="hidden" name="options[site_title]" value="Hacked by CSRF">
    <input type="submit" value="Click me">
</form>
<script>
    document.forms[0].submit();
</script>
</body>
</html>

3. Host the HTML page on an attacker-controlled server or send it as an email attachment.
4. Trick the victim (an admin) into visiting the page. The form auto-submits, changing the site title.

Note: No public exploit code is available in Exploit-DB or other repositories.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with actions related to the Benevolent theme (e.g., benevolent_save_settings).
• Look for requests lacking a _wpnonce parameter in the POST body.
• Analyze server logs for repeated requests from external IPs targeting theme-specific endpoints.

Prevention:

• Apply a Web Application Firewall (WAF) rule to block requests to theme AJAX endpoints that do not include a valid nonce.
• Use a security plugin like Wordfence or Sucuri to add CSRF protection.
• Educate administrators to avoid clicking suspicious links while logged into WordPress.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=benevolent_save_settings or similar.
  • Referer header missing or spoofed (e.g., from an external domain).
• File IOCs:
  • Modified theme options in the database (e.g., wp_options table with benevolent_theme_options).
  • Unexpected changes to site title, tagline, or custom CSS.
• Behavioral IOCs:
  • Administrator accounts performing actions without their knowledge.
  • Unexplained changes to theme settings.

Detection Engineering

YARA Rule

rule CVE_2024_37450_CSRF_Benevolent {
    meta:
        description = "Detects CSRF exploitation attempts against Benevolent theme"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-37450"
    strings:
        $ajax_action = "benevolent_save_settings" nocase
        $theme_option = "benevolent_theme_options" nocase
        $post_method = "POST" nocase
    condition:
        $ajax_action and $theme_option and $post_method
}

Sigma Rule

title: CVE-2024-37450 CSRF Exploitation Against Benevolent Theme
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects CSRF attempts targeting the Benevolent WordPress theme
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=benevolent_save_settings'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37450 CSRF Exploitation Against Benevolent Theme"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=benevolent_save_settings"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Benevolent theme and switch to a different, actively maintained theme.
2. Manually add CSRF protection by editing the theme’s functions.php file to include nonce checks (see patched code example above).
3. Use a security plugin that adds CSRF tokens to all admin requests.

Long-term Recommendations:

• Replace the theme with a supported alternative from the WordPress repository.
• Monitor vendor updates for a future patch. If none is released, consider the theme abandoned.
• Implement a Web Application Firewall (WAF) with rules to block CSRF attacks.
• Educate administrators on phishing risks and the importance of verifying URLs before clicking.

Patch Status: No official patch available. Users must apply manual mitigations or replace the theme.

Valters IT