CVE-2024-0768 Overview
CVE-2024-0768 is a Cross-Site Request Forgery (CSRF) vulnerability in the Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.4.4 and stems from missing or incorrect nonce validation on the ajax_theme_activation function. Unauthenticated attackers can activate arbitrary installed themes on a target site by tricking an administrator into clicking a crafted link. The vulnerability is classified under [CWE-352] and requires user interaction to exploit.
Critical Impact
An attacker can change the active WordPress theme on a vulnerable site by luring an authenticated administrator to a malicious page, disrupting site presentation and potentially activating themes containing exploitable code.
Affected Products
- Envothemes Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress
- All plugin versions up to and including 1.4.4
- WordPress sites where an administrator can be socially engineered into visiting attacker-controlled content
Discovery Timeline
- 2024-02-28 - CVE-2024-0768 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0768
Vulnerability Analysis
The vulnerability resides in the plugin's AJAX handler responsible for activating themes from the bundled template library. The ajax_theme_activation function processes requests to switch the active WordPress theme but does not verify a valid WordPress nonce before executing the state-changing operation. Without nonce validation, the request handler cannot distinguish between a legitimate administrator action initiated inside the WordPress admin interface and a forged request originating from a third-party site.
An attacker leverages the authenticated session of an administrator by delivering an HTML page, email, or link that triggers a request to the vulnerable AJAX endpoint. When the administrator visits the attacker-controlled resource, the browser attaches the WordPress session cookies to the request, and the plugin executes theme activation as if the administrator had performed the action themselves. The attacker does not need credentials for the target site.
Root Cause
The root cause is the absence of a check_ajax_referer or equivalent wp_verify_nonce call inside the ajax_theme_activation handler defined in includes/admin/include/template-library.php. WordPress provides nonce tokens specifically to prevent CSRF against authenticated endpoints, and the omission leaves the theme activation endpoint reachable through forged cross-origin requests.
Attack Vector
Exploitation requires network reach to the target WordPress site and social engineering to trigger administrator interaction. The attacker hosts a page containing a form, image, or script that issues a request to the vulnerable AJAX action with parameters selecting the theme to activate. When an authenticated administrator loads the page, the browser sends the request with valid session cookies, and the server activates the specified theme. See the WordPress Template Library Code reference for the affected function location.
The vulnerability is described in prose because no verified proof-of-concept code is publicly available. Refer to the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-0768
Indicators of Compromise
- Unexpected changes to the active WordPress theme recorded in the wp_options table under the template and stylesheet keys
- Web server access log entries containing POST requests to admin-ajax.php with the ajax_theme_activation action and an HTTP Referer header pointing outside the site's own domain
- Administrator sessions loading external pages immediately preceding theme activation events
Detection Strategies
- Correlate admin-ajax.php requests targeting theme activation actions with the originating Referer and Origin headers to identify cross-origin invocations
- Monitor WordPress audit logs or activity plugins for theme change events that lack a corresponding administrator action in the wp-admin interface
- Alert on installations of the Envo's Elementor Templates & Widgets for WooCommerce plugin at versions 1.4.4 or earlier during asset inventory scans
Monitoring Recommendations
- Enable a WordPress audit logging plugin that records theme activation events with the initiating user and request context
- Forward web server access logs and WordPress event logs to a centralized log platform for cross-source correlation
- Track plugin inventory across managed WordPress sites and flag vulnerable versions of envo-elementor-for-woocommerce
How to Mitigate CVE-2024-0768
Immediate Actions Required
- Update the Envo's Elementor Templates & Widgets for WooCommerce plugin to a version later than 1.4.4 that includes the nonce validation fix
- Audit the currently active WordPress theme on affected sites and revert to the intended theme if an unauthorized change is detected
- Instruct administrators to log out of WordPress sessions before browsing untrusted external content
Patch Information
The vendor addressed the issue by adding nonce validation to the vulnerable AJAX handler. Review the WordPress Changeset Overview for the specific code change, and apply the latest plugin release available in the WordPress plugin repository.
Workarounds
- Deactivate and remove the Envo's Elementor Templates & Widgets for WooCommerce plugin until the patched version can be installed
- Restrict access to the WordPress admin interface using IP allowlists or a web application firewall rule that blocks cross-origin POST requests to admin-ajax.php for the ajax_theme_activation action
- Require administrators to use isolated browser profiles or dedicated browsers for WordPress administration to reduce the risk of session reuse against attacker-controlled pages
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.