CVE-2024-6751

Executive Summary

CVE-2024-6751 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Social Auto Poster plugin for WordPress, up to and including version 5.3.14. The vulnerability stems from missing or incorrect nonce validation on multiple functions, allowing an unauthenticated attacker to trick a logged-in administrator into performing unintended actions. Successful exploitation enables the attacker to add, modify, or delete post meta and plugin options, potentially leading to unauthorized configuration changes, data corruption, or privilege escalation within the WordPress ecosystem.

This vulnerability is classified as a WordPress plugin issue and does not involve Apache or Nginx directly. The CVSS score of 6.3 (Medium) reflects the need for user interaction but highlights the high impact on integrity. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild. However, the lack of a patch from the vendor increases the risk for unpatched installations.

Supply Chain & Package Security

This vulnerability is specific to the Social Auto Poster WordPress plugin. As a WordPress plugin, it is distributed via the WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. No known supply chain compromise has been reported, but the absence of a patch means users must rely on manual mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need authentication.
• User Interaction (UI): Required – The victim must perform an action (e.g., click a link).
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None – No data exposure.
• Integrity (I): High – Unauthorized modification of post meta and plugin options.
• Availability (A): None – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the high integrity impact and lack of a patch make it a significant concern for WordPress site administrators.

Deep Dive & Mechanics

The Social Auto Poster plugin is designed to automatically publish WordPress posts to social media platforms. The vulnerability lies in the plugin's failure to implement proper CSRF nonce validation on several administrative functions. In WordPress, nonces are used to verify that requests originate from the intended user and are not forged. Without this validation, an attacker can craft a malicious link or form that, when clicked by an authenticated administrator, performs unauthorized actions.

The affected functions likely include those that handle:

• Adding, modifying, or deleting post meta (custom fields).
• Changing plugin options (e.g., API keys, social media account settings, posting schedules).

An attacker can exploit this by:

1. Crafting a malicious HTML page or email containing a CSRF payload.
2. Tricking an authenticated WordPress administrator into visiting the page.
3. The payload sends a forged request to the WordPress site, modifying post meta or plugin options without the administrator's knowledge.

For example, an attacker could change the plugin's API key to their own, redirecting social media posts to their accounts, or delete critical post meta, causing data loss.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is identified by the absence of nonce checks. A typical vulnerable function might look like:

// Vulnerable: No nonce verification
function sap_update_post_meta($post_id, $meta_key, $meta_value) {
    update_post_meta($post_id, $meta_key, $meta_value);
}

A patched version would include a nonce check:

// Patched: Nonce verification added
function sap_update_post_meta($post_id, $meta_key, $meta_value) {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'sap_update_post_meta')) {
        return;
    }
    update_post_meta($post_id, $meta_key, $meta_value);
}

The patch would need to be applied to all functions that handle POST requests without nonce validation. Until the vendor releases an update, users must implement workarounds.

Exploitation & Lab Setup

Red Team (Attacker) Perspective

Prerequisites:

• A WordPress site with the Social Auto Poster plugin (<= 5.3.14) installed and an authenticated administrator session.
• Ability to host a malicious HTML page or send a crafted email.

Exploitation Steps:

1. Identify the vulnerable endpoints by analyzing the plugin's source code (e.g., admin-ajax.php actions or admin page submissions).
2. Craft a CSRF payload. For example, to change a plugin option:

   <html>
   <body>
   <form action="http://target-site.com/wp-admin/admin-post.php" method="POST">
       <input type="hidden" name="action" value="sap_update_option" />
       <input type="hidden" name="option_name" value="sap_api_key" />
       <input type="hidden" name="option_value" value="attacker_controlled_key" />
       <input type="submit" value="Click me" />
   </form>
   <script>document.forms[0].submit();</script>
   </body>
   </html>
   

3. Host the HTML file on an attacker-controlled server or send it as an email.
4. Trick the administrator into visiting the page (e.g., via social engineering).
5. The request is sent with the administrator's cookies, and the plugin option is modified.

Expected Outcome: The attacker gains control over plugin settings, potentially exfiltrating data or disrupting social media posting.

Blue Team (Defender) Perspective

Detection:

• Monitor for unusual POST requests to admin-post.php or admin-ajax.php with actions related to the Social Auto Poster plugin.
• Look for changes to plugin options or post meta without corresponding user activity.

Lab Setup:

1. Install WordPress and the Social Auto Poster plugin (version 5.3.14) in a controlled environment.
2. Create an administrator account and log in.
3. Use a tool like Burp Suite to intercept and analyze requests.
4. Simulate the CSRF attack using a crafted HTML page and observe the changes.

Mitigation in Lab:

• Implement a Web Application Firewall (WAF) rule to block requests missing nonce parameters.
• Use WordPress security plugins that add CSRF protection.

Indicators of Compromise (IOCs)

• Network:
  • Unusual POST requests to /wp-admin/admin-post.php with parameters like action=sap_update_option or action=sap_delete_meta.
  • Referer headers from unexpected domains (e.g., attacker-controlled sites).
• Host:
  • Modified plugin options in the wp_options table (e.g., sap_api_key changed).
  • Unexpected post meta entries in wp_postmeta.
• Logs:
  • WordPress debug logs showing failed nonce checks (if logging is enabled).
  • Web server access logs with POST requests to admin endpoints from unusual IPs.

Detection Engineering

YARA Rule

rule CVE_2024_6751_CSRF_SocialAutoPoster {
    meta:
        description = "Detects potential CSRF exploitation attempts against Social Auto Poster plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6751"
    strings:
        $action1 = "sap_update_option" ascii wide nocase
        $action2 = "sap_delete_meta" ascii wide nocase
        $action3 = "sap_add_meta" ascii wide nocase
        $nonce_missing = "_wpnonce" ascii wide nocase
    condition:
        any of ($action*) and not $nonce_missing
}

Sigma Rule

title: CVE-2024-6751 - Social Auto Poster CSRF Exploitation
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects POST requests to WordPress admin endpoints with Social Auto Poster actions missing nonce
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains:
            - 'action=sap_update_option'
            - 'action=sap_delete_meta'
            - 'action=sap_add_meta'
    filter:
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with nonce (should be filtered)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6751 - Social Auto Poster CSRF Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-post.php"; http_uri; content:"action=sap_update_option"; http_client_body; nocase; pcre:"/^(?!.*_wpnonce).*$/R"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available from the vendor.
2. Implement CSRF protection manually by adding nonce checks to the plugin's functions (if you have development resources).
3. Use a Web Application Firewall (WAF) to block requests to admin endpoints without nonce parameters.
4. Educate administrators about phishing attacks that may attempt to exploit this vulnerability.

Long-term Solutions:

• Monitor the vendor's website for an official patch and apply it as soon as it is released.
• Consider replacing the plugin with an alternative that has active security support.
• Regularly audit WordPress plugins for known vulnerabilities using tools like WPScan.

Workaround Code (if you must keep the plugin): Add the following to your theme's functions.php to enforce nonce checks on all POST requests to the plugin's admin actions:

add_action('admin_init', function() {
    if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) {
        $allowed_actions = array('sap_update_option', 'sap_delete_meta', 'sap_add_meta');
        if (in_array($_POST['action'], $allowed_actions)) {
            if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], $_POST['action'])) {
                wp_die('CSRF validation failed.');
            }
        }
    }
});

Valters IT
Securing Digital Frontiers