CVE-2024-11444: CLUEVO LMS WordPress Plugin CSRF Vulnerability

CVE-2024-11444 Overview

CVE-2024-11444 affects the CLUEVO LMS, E-Learning Platform plugin for WordPress in all versions up to and including 1.13.2. The vulnerability is a Cross-Site Request Forgery (CSRF) issue [CWE-352] caused by missing or incorrect nonce validation in the cluevo_render_module_ui() function. Unauthenticated attackers can delete learning modules by tricking a site administrator into clicking a crafted link or visiting an attacker-controlled page. Exploitation requires user interaction from a privileged account but requires no authentication on the attacker's side.

Critical Impact

Successful exploitation allows unauthenticated attackers to delete CLUEVO LMS modules, resulting in loss of course content integrity and disruption to e-learning operations.

Affected Products

• CLUEVO LMS, E-Learning Platform plugin for WordPress
• All versions up to and including 1.13.2
• WordPress sites with CLUEVO LMS installed and active

Discovery Timeline

• 2024-12-06 - CVE-2024-11444 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11444

Vulnerability Analysis

The flaw resides in the cluevo_render_module_ui() function within functions/functions.module-management.inc.php of the CLUEVO LMS plugin. This function handles module management operations, including module deletion, but does not enforce a valid WordPress nonce before executing state-changing actions. Without nonce verification, the server cannot distinguish between a legitimate administrator action and a forged request originating from an attacker-controlled origin.

An attacker crafts a malicious page or link that submits a deletion request to the vulnerable endpoint. When an authenticated administrator visits the page while logged in, the browser automatically attaches session cookies to the outgoing request. The plugin then processes the request as if the administrator had initiated it, deleting the targeted module.

Root Cause

The root cause is missing anti-CSRF token validation. WordPress provides the wp_verify_nonce() and check_admin_referer() primitives to protect privileged actions, but the vulnerable function does not call these before executing module deletion logic. This design gap allows any cross-origin request that reaches the endpoint with valid session cookies to succeed.

Attack Vector

Exploitation occurs over the network and requires user interaction from a site administrator. The attacker delivers a link, email, forum post, or embedded resource that triggers an HTTP request to the vulnerable endpoint. No prior authentication or privileges are needed on the attacker's side. Impact is limited to integrity, specifically the unauthorized deletion of learning modules managed by the plugin.

See the WordPress Cluevo LMS Code Review (L925) and line 928 for the exact location of the missing nonce check. No public proof-of-concept exploit code is available at this time.

Detection Methods for CVE-2024-11444

Indicators of Compromise

• Unexpected deletion of CLUEVO LMS modules from the WordPress admin dashboard.
• HTTP POST or GET requests to CLUEVO module management endpoints with Referer headers pointing to external or unknown domains.
• Administrator session activity immediately following clicks on suspicious external links.

Detection Strategies

• Review web server access logs for requests to CLUEVO LMS module management URLs originating with third-party Referer headers.
• Enable and audit WordPress activity logs to correlate module deletion events with administrator browsing sessions.
• Deploy a Web Application Firewall (WAF) rule that inspects state-changing requests to CLUEVO endpoints for the presence of a valid WordPress nonce parameter.

Monitoring Recommendations

• Monitor for anomalous administrator activity, including deletions occurring outside normal maintenance windows.
• Alert on any CLUEVO plugin file or database change events that lack a corresponding authenticated admin workflow.
• Track outbound clicks from administrator email accounts and correlate with subsequent site changes.

How to Mitigate CVE-2024-11444

Immediate Actions Required

• Update the CLUEVO LMS plugin to a version newer than 1.13.2 as soon as a patched release is available from the vendor.
• Restrict administrator accounts from browsing untrusted sites while logged into the WordPress admin panel.
• Enforce least privilege by limiting the number of users with module management capabilities.

Patch Information

The vendor has published readme updates via the plugin repository. Review the WordPress Cluevo LMS Changeset and the Wordfence Vulnerability Report for the latest remediation status and fixed version details.

Workarounds

• Deactivate and remove the CLUEVO LMS plugin until a patched version is installed if module management is not business critical.
• Deploy a WAF rule that blocks CLUEVO module management requests missing a valid _wpnonce parameter or with off-site Referer headers.
• Require administrators to use a dedicated browser profile or session for WordPress administration to reduce CSRF exposure.

# Example WAF rule (ModSecurity) blocking CSRF against CLUEVO module management
SecRule REQUEST_URI "@contains cluevo" \
  "chain,phase:2,deny,status:403,id:1004411,\
   msg:'CVE-2024-11444 - CLUEVO LMS CSRF attempt blocked'"
  SecRule &ARGS:_wpnonce "@eq 0"