CVE-2024-0767 Overview
CVE-2024-0767 is a Cross-Site Request Forgery (CSRF) vulnerability in the Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.4.4. The ajax_plugin_activation function lacks proper nonce validation, allowing unauthenticated attackers to activate arbitrary installed plugins on a vulnerable WordPress site. Exploitation requires tricking an authenticated administrator into clicking a crafted link or visiting a malicious page. The issue is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
Unauthenticated attackers can activate any installed WordPress plugin, potentially enabling further exploitation through vulnerable or malicious plugins already present on the server.
Affected Products
- Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress
- All versions up to and including 1.4.4
- WordPress sites running the plugin with an authenticated administrator session
Discovery Timeline
- 2024-02-28 - CVE-2024-0767 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0767
Vulnerability Analysis
The vulnerability resides in the ajax_plugin_activation function within includes/admin/include/template-library.php. WordPress relies on nonce tokens to bind sensitive state-changing actions to an authenticated user session. The affected function processes plugin activation requests without validating a nonce, breaking that trust boundary. An attacker who convinces an administrator to load an attacker-controlled page can cause the browser to issue a forged authenticated request. The plugin then activates a plugin of the attacker's choosing on the target site. If a vulnerable or backdoored plugin is already installed but inactive, this CSRF becomes a stepping stone toward remote code execution or persistent compromise.
Root Cause
The root cause is missing or incorrect nonce validation in the AJAX handler responsible for plugin activation. Under a correct implementation, the handler would call check_ajax_referer() or wp_verify_nonce() before invoking activate_plugin(). The affected code path omits this check, so any request bearing valid session cookies is treated as authorized. This is a classic instance of CWE-352, where server-side logic depends solely on ambient authentication.
Attack Vector
Exploitation is network-based and requires user interaction from an administrator. An attacker hosts a page containing an auto-submitting HTML form or fetch() call targeting the site's admin-ajax.php endpoint with the ajax_plugin_activation action and a chosen plugin slug. When the administrator visits the page while logged in, the browser attaches session cookies and the activation succeeds. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the vulnerable handler.
No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose above; refer to the vendor changeset for the exact modified logic.
Detection Methods for CVE-2024-0767
Indicators of Compromise
- Unexpected plugin activation events recorded in WordPress audit logs or the wp_options table active_plugins entry.
- HTTP POST requests to /wp-admin/admin-ajax.php with an action parameter referencing the plugin activation handler and a cross-origin Referer header.
- Administrator sessions immediately preceded by navigation to an unfamiliar external URL in browser history or proxy logs.
Detection Strategies
- Inventory installed versions of Envo's Elementor Templates & Widgets for WooCommerce and flag any instance at or below 1.4.4.
- Alert on AJAX requests to plugin activation actions where the Referer header does not match the site's own origin.
- Correlate WordPress plugin state changes with the authenticated user, source IP, and originating referrer to identify forged requests.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record plugin activation, deactivation, and administrator authentication events.
- Forward web server access logs and WordPress audit events to a centralized SIEM for correlation across sessions and referrers.
- Monitor filesystem changes under wp-content/plugins/ and integrity of the active_plugins option for unexpected modifications.
How to Mitigate CVE-2024-0767
Immediate Actions Required
- Update Envo's Elementor Templates & Widgets for WooCommerce to a version later than 1.4.4 that includes the fix from the WordPress Plugin Changeset.
- Audit the list of installed plugins and remove any that are unused, outdated, or unmaintained to shrink the activation attack surface.
- Force administrator re-authentication and review recent plugin activation history for unauthorized changes.
Patch Information
The vendor addressed the issue in the plugin source tree by adding nonce validation to the ajax_plugin_activation handler. Details of the fix are available in the WordPress Plugin Changeset 3041303. Site operators should upgrade to the first plugin release incorporating this changeset.
Workarounds
- Deactivate and uninstall the plugin until an upgrade is applied if the update cannot be deployed immediately.
- Restrict /wp-admin/admin-ajax.php access to trusted IP ranges using a web application firewall or reverse proxy.
- Configure a WAF rule to block cross-origin POST requests to admin-ajax.php whose Referer header does not match the site's own domain.
- Enforce browser-level protections by requiring administrators to use separate, hardened browser profiles for WordPress administration.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
