CVE-2024-12206: Pearl Header Builder CSRF Vulnerability

CVE-2024-12206 Overview

CVE-2024-12206 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Header Builder Plugin – Pearl. The flaw affects all plugin versions up to and including 1.3.8. The root cause is missing or incorrect nonce validation on the stm_header_builder page. Unauthenticated attackers can delete arbitrary headers by tricking an authenticated administrator into clicking a crafted link. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation lets remote attackers delete arbitrary site headers through forged requests, disrupting site presentation and navigation elements managed by the plugin.

Affected Products

WordPress Header Builder Plugin – Pearl (all versions ≤ 1.3.8)
WordPress sites with the Pearl Header Builder plugin installed and active
Administrator sessions authenticated to vulnerable installations

Discovery Timeline

2025-01-09 - CVE-2024-12206 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12206

Vulnerability Analysis

The vulnerability resides in the plugin's stm_header_builder administrative page. This handler processes header management actions, including deletion of stored header configurations. The handler does not verify a WordPress nonce or performs the check incorrectly. As a result, the server accepts state-changing requests without confirming that they originated from an intentional administrator action.

The request requires user interaction from an authenticated administrator. An attacker crafts a link or embeds a request in an external page. When a logged-in administrator visits the attacker-controlled resource, the browser submits the forged request using the administrator's session cookies. The plugin executes the deletion without validating request origin.

Impact is limited to integrity of the plugin's header configurations. Confidentiality and availability of the underlying site are not directly affected. However, arbitrary deletion of header definitions can degrade site functionality and require manual restoration.

Root Cause

WordPress provides nonce APIs (wp_create_nonce, check_admin_referer, wp_verify_nonce) to protect administrative actions from CSRF. The Pearl Header Builder plugin either omits nonce generation on the deletion action or fails to validate the submitted token server-side. This gap in CWE-352 controls allows any request bearing valid session cookies to succeed.

Attack Vector

Exploitation follows a standard CSRF pattern. The attacker hosts a malicious page or sends a phishing message containing a link, image tag, or auto-submitting form targeting the vulnerable stm_header_builder endpoint. The attacker must social-engineer an authenticated administrator into loading the resource. No credentials, tokens, or prior access to the target site are required.

Refer to the Wordfence Vulnerability Report and the WordPress Plugin Changeset for technical details of the affected handler and the patch.

Detection Methods for CVE-2024-12206

Indicators of Compromise

Unexpected disappearance of header configurations from the Pearl Header Builder admin interface
HTTP POST or GET requests to the stm_header_builder page with Referer headers pointing to external, untrusted domains
Administrator account activity showing header deletion actions immediately after clicking an external link or email
Web server access logs showing header deletion requests without preceding legitimate admin navigation

Detection Strategies

Review web server access logs for requests to wp-admin/admin.php?page=stm_header_builder with suspicious Referer values or missing nonce parameters
Enable WordPress audit logging plugins to record administrative configuration changes and correlate deletions to user session context
Monitor for anomalous administrator behavior patterns, including configuration changes shortly after browsing external sites

Monitoring Recommendations

Ingest WordPress access and audit logs into a centralized SIEM for alerting on stm_header_builder deletion actions
Alert on any header-management requests lacking a valid _wpnonce parameter
Correlate administrator email activity and browsing telemetry with subsequent plugin configuration changes

How to Mitigate CVE-2024-12206

Immediate Actions Required

Update the WordPress Header Builder Plugin – Pearl to a version newer than 1.3.8 as soon as the vendor releases a patched build
Audit existing header configurations and back them up before applying updates or investigating suspicious deletions
Instruct administrators to log out of WordPress before browsing untrusted sites or opening unsolicited links

Patch Information

A fix is referenced in the WordPress Plugin Changeset 3218670 for the pearl-header-builder repository. Administrators should upgrade to the version incorporating this changeset. Consult the Wordfence advisory for the confirmed fixed version.

Workarounds

Deactivate the Pearl Header Builder plugin until a patched version is installed if header management is not business-critical
Restrict administrative access to the WordPress dashboard using IP allowlists or a web application firewall (WAF) rule blocking external requests to stm_header_builder
Deploy a WAF rule requiring a valid Referer matching the site's own origin for administrative POST requests
Enforce short administrator session lifetimes and require re-authentication for sensitive plugin configuration pages

bash

# Example WAF rule (ModSecurity) blocking cross-origin requests to the vulnerable page
SecRule REQUEST_URI "@contains page=stm_header_builder" \
    "chain,deny,status:403,id:1002024,msg:'CVE-2024-12206 CSRF block'"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example.com" "t:none"