CVE-2024-11342: Skt NURCaptcha CSRF Vulnerability

CVE-2024-11342 Overview

The Skt NURCaptcha plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 3.5.0. The flaw stems from missing or incorrect nonce validation in the skt-nurc-admin.php file. Unauthenticated attackers can update plugin settings and inject malicious web scripts by tricking a site administrator into clicking a crafted link. This vulnerability is tracked under CWE-352: Cross-Site Request Forgery and requires user interaction to succeed. The issue affects WordPress sites that have the plugin installed and active.

Critical Impact
Successful exploitation allows attackers to modify plugin configuration and inject stored scripts into administrative contexts, enabling downstream Cross-Site Scripting (XSS) attacks against site users.

Affected Products

Skt NURCaptcha WordPress plugin versions up to and including 3.5.0
WordPress installations with the vulnerable plugin active
Administrator accounts on affected WordPress sites

Discovery Timeline

2024-11-26 - CVE-2024-11342 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11342

Vulnerability Analysis

The vulnerability resides in the plugin's administrative handler, skt-nurc-admin.php. WordPress security best practice requires that state-changing administrative actions verify a cryptographic nonce using functions such as wp_verify_nonce() or check_admin_referer(). The Skt NURCaptcha plugin fails to enforce this validation on settings-update requests.

Because the request handler does not confirm the origin of the submission, any browser session authenticated as an administrator will accept forged POST requests. An attacker who lures an administrator to a malicious page can cause that browser to submit arbitrary plugin configuration changes. The impact extends beyond simple configuration tampering: attacker-controlled values are rendered in administrative contexts, enabling script injection that executes with administrator privileges.

Root Cause

The root cause is missing or improperly implemented nonce validation in the administrative settings handler. WordPress nonces are single-use tokens that bind a request to a specific user session and action. Without this check, the plugin trusts any authenticated request regardless of origin, violating the CSRF protection model that WordPress provides through its nonce API.

Attack Vector

Exploitation requires an unauthenticated attacker to craft a malicious HTML page or link containing a hidden form or JavaScript that submits a request to the vulnerable admin endpoint. The attacker then delivers this link to a site administrator through phishing, social media, or a compromised page. When the administrator visits the attacker-controlled resource while logged into WordPress, the browser automatically includes session cookies, and the forged request executes with administrator privileges. The injected script payload then persists in plugin settings and executes when the administrator loads affected pages.

The vulnerability mechanism is documented in the plugin source at WordPress Plugin Source Code and analyzed in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-11342

Indicators of Compromise

Unexpected modifications to Skt NURCaptcha plugin settings without corresponding administrator activity in access logs
Presence of <script> tags or JavaScript event handlers within stored plugin configuration values
Administrator-initiated POST requests to plugin admin endpoints originating from external Referer headers
Anomalous outbound requests from administrator browsers following visits to untrusted sites

Detection Strategies

Review WordPress access logs for POST requests to wp-admin/admin.php targeting the skt-nurcaptcha page parameter that lack the expected _wpnonce token
Inspect the plugin's stored options in the wp_options table for HTML or JavaScript content that should not appear in configuration fields
Monitor administrator sessions for cross-origin form submissions using Web Application Firewall (WAF) telemetry
Correlate plugin update events with administrator authentication timestamps to identify forged requests

Monitoring Recommendations

Enable request logging on the WordPress admin interface and retain logs for forensic review
Deploy a WAF rule that blocks state-changing requests to plugin admin pages lacking valid Referer and nonce parameters
Alert on modifications to plugin options tables outside of scheduled maintenance windows
Track administrator browser telemetry for interactions with untrusted external domains

How to Mitigate CVE-2024-11342

Immediate Actions Required

Update the Skt NURCaptcha plugin to a patched release beyond version 3.5.0 as soon as one is available from the vendor
Deactivate and remove the plugin if a patched version is not available and the plugin is not essential
Audit current plugin settings for any injected script content and reset affected fields to known-good values
Instruct administrators to log out of WordPress before browsing untrusted sites

Patch Information

Refer to the WordPress Plugin Revision History and WordPress Changeset Overview to review vendor code changes. Consult the Wordfence Vulnerability Report for the latest remediation guidance and fixed version details.

Workarounds

Restrict administrator access to the WordPress dashboard using IP allowlisting at the web server or WAF layer
Enforce use of dedicated browser profiles or sessions for WordPress administration to reduce CSRF exposure
Deploy a WAF rule that requires a valid _wpnonce parameter on all POST requests to the plugin's admin endpoints
Apply the principle of least privilege by limiting the number of accounts holding the administrator role

bash

# Example WAF rule (ModSecurity) to block admin POST requests missing a nonce
SecRule REQUEST_URI "@contains /wp-admin/admin.php" \
  "chain,phase:2,deny,status:403,id:1009342,msg:'CVE-2024-11342 CSRF protection'"
  SecRule REQUEST_METHOD "@streq POST" "chain"
  SecRule ARGS:page "@contains skt-nurcaptcha" "chain"
  SecRule &ARGS:_wpnonce "@eq 0"