CVE-2024-10711: Ithemelandco WooCommerce Report CSRF Flaw

CVE-2024-10711 Overview

CVE-2024-10711 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the WooCommerce Report plugin for WordPress, developed by ithemelandco. The flaw exists in all versions up to and including 1.5.1. It stems from missing or incorrect nonce validation on the settings update functionality. Unauthenticated attackers can update arbitrary plugin options by tricking a site administrator into clicking a crafted link. Successful exploitation can lead to privilege escalation on the affected WordPress site.

Critical Impact

Attackers can leverage forged administrator requests to modify arbitrary plugin options, enabling privilege escalation and full administrative takeover of vulnerable WordPress installations.

Affected Products

• ithemelandco WooCommerce Report plugin for WordPress (all versions ≤ 1.5.1)
• WordPress sites running the ithemelandco-woo-report plugin
• WooCommerce installations relying on this reporting extension

Discovery Timeline

• 2024-11-05 - CVE-2024-10711 published to NVD
• 2024-11-07 - Last updated in NVD database

Technical Details for CVE-2024-10711

Vulnerability Analysis

The WooCommerce Report plugin exposes a settings update handler that processes administrative actions without validating WordPress nonces. WordPress nonces are single-use tokens that bind a request to a specific user session and action. When this token check is absent or implemented incorrectly, the server cannot distinguish between a legitimate administrator action and a forged cross-origin request. An attacker crafts a malicious page or link that triggers a state-changing HTTP request against the target site. If a logged-in administrator visits the attacker-controlled resource, the browser submits the request with the administrator's session cookies. The plugin then accepts the forged input and updates configuration options, including values that can be abused to escalate privileges.

Root Cause

The root cause is missing or incorrect nonce validation in the settings update routine of the plugin, referenced at class/setting_report.php line 1174. The handler does not call check_admin_referer() or wp_verify_nonce() before processing submitted option values. This violates the WordPress security model for authenticated state-changing operations and matches the CWE-352 pattern.

Attack Vector

Exploitation requires user interaction: an administrator must click a malicious link or load an attacker-controlled page while authenticated. The attack travels over the network, requires no prior privileges from the attacker, and has low complexity. Once the forged request executes, the attacker can modify arbitrary plugin options. Manipulated options can be chained to register privileged accounts or alter configuration to gain administrative control, resulting in high impact on confidentiality, integrity, and availability.

No public proof-of-concept exploit and no CISA KEV listing are associated with this CVE at the time of publication. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2024-10711

Indicators of Compromise

• Unexpected changes to WooCommerce Report plugin settings or general WordPress options recorded in the database wp_options table.
• New administrator accounts or role changes that cannot be tied to legitimate administrative activity.
• HTTP POST requests to plugin endpoints originating from external Referer headers or unusual domains.
• Administrator browser history showing visits to untrusted sites immediately preceding configuration changes.

Detection Strategies

• Audit installed WordPress plugins for ithemelandco-woo-report at version 1.5.1 or earlier.
• Inspect web server access logs for POST requests to the plugin's settings update endpoint without a matching _wpnonce parameter.
• Compare current plugin and site option values against a known-good baseline to identify unauthorized modifications.

Monitoring Recommendations

• Enable WordPress audit logging to record option updates, user role changes, and plugin configuration events.
• Forward web server and WordPress application logs to a centralized SIEM for correlation across administrator sessions.
• Alert on creation of new administrator accounts and on changes to users_can_register or default_role options.

How to Mitigate CVE-2024-10711

Immediate Actions Required

• Update the WooCommerce Report plugin to a version newer than 1.5.1 that includes the fix from WordPress Changeset 3181117.
• If no patched release is available, deactivate and remove the plugin from affected WordPress sites.
• Review administrator accounts and revoke any unauthorized users or sessions created during the exposure window.
• Rotate administrator credentials and force re-authentication on all privileged accounts.

Patch Information

The vendor committed a fix in the WordPress plugin repository tracked under WordPress Changeset 3181117. Administrators should install the latest version of the plugin from the official WordPress plugin directory. Refer to the Ithemelandco WooCommerce Report documentation for upgrade guidance.

Workarounds

• Restrict access to the WordPress admin interface using IP allow-listing at the web server or WAF layer.
• Deploy a web application firewall rule to block POST requests to the plugin's settings endpoint that lack a valid _wpnonce parameter.
• Train administrators to avoid clicking untrusted links while authenticated to the WordPress dashboard and to use a separate browser profile for administrative tasks.
• Enforce SameSite=Strict or SameSite=Lax cookie attributes on WordPress authentication cookies to limit cross-site request submission.