CVE-2024-12004 Overview
CVE-2024-12004 is a Cross-Site Request Forgery [CWE-352] vulnerability in the WPC Order Notes for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.5.2. It stems from missing or incorrect nonce validation on the ajax_update_order_note() function. Unauthenticated attackers can inject malicious web scripts through forged requests when a site administrator is tricked into clicking a crafted link. Successful exploitation combines CSRF with a stored script injection, enabling actions in the context of an authenticated administrator session.
Critical Impact
Attackers can inject arbitrary scripts into WooCommerce order notes by tricking an administrator into visiting a malicious URL, leading to potential session compromise and administrative action abuse.
Affected Products
- WPC Order Notes for WooCommerce plugin for WordPress
- All versions up to and including 1.5.2
- WordPress sites running WooCommerce with the vulnerable plugin
Discovery Timeline
- 2024-12-11 - CVE-2024-12004 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12004
Vulnerability Analysis
The vulnerability resides in the plugin's AJAX handler ajax_update_order_note(), which processes requests to modify order notes. The handler does not perform proper nonce validation, so it accepts requests that originate from any external origin. An attacker crafts a page or link that submits an AJAX request to the vulnerable endpoint. When an authenticated administrator visits the attacker-controlled page, the browser transmits the request with valid session cookies. Because the plugin also fails to sanitize the note content on write, the attacker can inject script payloads that later execute in the administrator's browser context. The chained CSRF and stored script behavior expands the impact from a simple state-changing forgery to a scriptable takeover primitive.
Root Cause
The root cause is the absence of a WordPress nonce check inside ajax_update_order_note(). WordPress provides wp_verify_nonce() and check_ajax_referer() specifically to bind sensitive AJAX actions to a user session. The plugin skips this control, so origin verification never occurs. Details are visible in the WordPress Plugin Code Reference.
Attack Vector
Exploitation requires user interaction from an authenticated administrator, typically clicking a link or loading a page hosting attacker-controlled JavaScript. The malicious page issues a cross-origin POST to the WordPress admin-ajax.php endpoint targeting the vulnerable action. Because no nonce is required, the request is accepted, the order note is updated with attacker-supplied content, and any injected scripts run under the site's origin the next time the note is rendered. See the Wordfence Vulnerability Analysis for additional context.
Detection Methods for CVE-2024-12004
Indicators of Compromise
- Unexpected modifications to WooCommerce order notes containing HTML or <script> tags
- POST requests to admin-ajax.php with the update_order_note action originating from external Referer headers
- Administrator sessions generating order note updates shortly after visiting external URLs
Detection Strategies
- Inspect web server access logs for POST requests to wp-admin/admin-ajax.php where the Referer header is not a same-origin WordPress URL
- Deploy web application firewall rules that flag AJAX requests to the plugin's action missing a valid _wpnonce parameter
- Review the WooCommerce order note history for entries containing script-like content or unexpected HTML
Monitoring Recommendations
- Enable WordPress audit logging for plugin AJAX actions and administrator session activity
- Alert on outbound clicks or referrals from administrator accounts that immediately precede content changes
- Monitor plugin version inventory across WordPress installations to identify sites still running 1.5.2 or earlier
How to Mitigate CVE-2024-12004
Immediate Actions Required
- Update the WPC Order Notes for WooCommerce plugin to a version later than 1.5.2 as published by the vendor
- Audit existing order notes for injected HTML or JavaScript and remove any suspicious content
- Rotate administrator session cookies and passwords if suspicious note modifications are found
Patch Information
The vendor addressed the issue in a subsequent release referenced in WordPress Changeset 3205072. Administrators should confirm the installed version through the WordPress plugin dashboard and consult the Woo Order Notes Developers Page for the latest release notes.
Workarounds
- Disable the WPC Order Notes for WooCommerce plugin until it can be updated
- Restrict administrator browsing to trusted sites and require separate browsers or profiles for WordPress administration
- Deploy a web application firewall rule that blocks requests to the vulnerable AJAX action lacking a valid nonce parameter
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.