CVE-2024-12288 Overview
The Simple Add Pages or Posts plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 2.0.0. The flaw stems from missing or incorrect nonce validation in the plugin's settings handler. Unauthenticated attackers can update plugin settings and inject malicious web scripts by tricking a site administrator into clicking a crafted link. Successful exploitation leads to stored script injection executed in the administrator's browser context. The issue is tracked under CWE-352 and referenced in the Wordfence Vulnerability Report.
Critical Impact
An unauthenticated attacker can modify plugin settings and inject persistent scripts into a WordPress site by tricking an administrator into clicking a forged request.
Affected Products
- WordPress Simple Add Pages or Posts plugin, all versions through 2.0.0
- Any WordPress installation with the vulnerable plugin activated
- Administrator sessions accessing the WordPress dashboard while the plugin is installed
Discovery Timeline
- 2025-01-07 - CVE-2024-12288 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12288
Vulnerability Analysis
The vulnerability is a Cross-Site Request Forgery flaw in the settings update path of the Simple Add Pages or Posts plugin. The plugin's form handler processes administrative state-changing requests without verifying a WordPress nonce or equivalent anti-CSRF token. An attacker who can lure an authenticated administrator to a malicious page can cause the browser to submit an authenticated request on the admin's behalf. Because the accepted input is later rendered in the WordPress admin interface, the CSRF primitive escalates into stored script injection. The result combines unauthorized configuration change with client-side script execution in a privileged context.
Root Cause
The root cause is missing or incorrect nonce validation in the plugin's form.php handler, referenced in the WordPress Plugin Source Code. WordPress provides wp_nonce_field() and check_admin_referer() to bind sensitive requests to the current user session. The plugin does not enforce these checks before applying settings updates, so the server cannot distinguish an intentional admin action from a forged one.
Attack Vector
Exploitation requires user interaction. An attacker hosts a page containing an auto-submitting HTML form or image tag that targets the vulnerable plugin endpoint on a WordPress site. When an authenticated administrator visits the page, the browser sends the request with valid session cookies. The server accepts the request and stores the attacker-controlled input, which is later reflected in the admin interface and executed as script. The scope change in the CVSS vector reflects the crossover from CSRF into script execution in another security context.
No verified proof-of-concept code is published. See the Wordfence Vulnerability Report for additional technical details.
Detection Methods for CVE-2024-12288
Indicators of Compromise
- Unexpected modifications to Simple Add Pages or Posts plugin settings in the WordPress database, particularly in wp_options rows tied to the plugin.
- Presence of <script> tags, event handlers, or JavaScript payloads stored in plugin configuration fields.
- Administrator sessions loading external resources from unfamiliar domains after visiting third-party links.
Detection Strategies
- Review web server access logs for POST requests to the plugin's form handler that originate from off-site Referer headers.
- Audit plugin settings for HTML or script content that should be plain text or short configuration values.
- Correlate administrator browsing activity with outbound requests from the WordPress host to detect script-driven callbacks.
Monitoring Recommendations
- Enable request logging on /wp-admin/ endpoints and alert on state-changing POSTs lacking a same-origin Referer.
- Deploy a web application firewall rule that inspects Simple Add Pages or Posts requests for missing nonce parameters.
- Monitor file integrity of plugin files under wp-content/plugins/simple-add-pages-or-posts/ for tampering.
How to Mitigate CVE-2024-12288
Immediate Actions Required
- Deactivate the Simple Add Pages or Posts plugin on all WordPress sites until a patched release is available.
- Review plugin settings for injected script content and restore known-good values.
- Force reauthentication for administrator accounts and rotate any session-bound secrets.
Patch Information
At the time of publication, no fixed version beyond 2.0.0 is listed in the referenced advisories. Monitor the WordPress Plugin Developer Info page and the Wordfence Vulnerability Report for updated patch availability. If no patched version is released, remove the plugin from production sites.
Workarounds
- Uninstall the plugin and use a maintained alternative for adding pages or posts in bulk.
- Restrict access to the WordPress admin interface using IP allowlists or VPN gating.
- Require administrators to use a browser profile isolated from general web browsing to limit CSRF exposure.
# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate simple-add-pages-or-posts
wp plugin delete simple-add-pages-or-posts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
