CVE-2024-12385: WP Abstracts CSRF Vulnerability

CVE-2024-12385 Overview

The WP Abstracts plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 2.7.2. The flaw stems from missing nonce validation on the wpabstracts_load_status() and wpabstracts_delete_abstracts() functions. Unauthenticated attackers can inject malicious web scripts through forged requests if they trick a site administrator into clicking a crafted link. The vulnerability is classified under [CWE-352] (Cross-Site Request Forgery) and requires user interaction to succeed.

Critical Impact
Successful exploitation allows unauthenticated attackers to delete abstracts and inject scripts into administrative contexts by leveraging authenticated administrator sessions.

Affected Products

Kevonadonis WP Abstracts plugin for WordPress (all versions ≤ 2.7.2)
WordPress sites using wp-abstracts-manuscripts-manager
Free edition distributed via the WordPress plugin directory

Discovery Timeline

2025-01-18 - CVE-2024-12385 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12385

Vulnerability Analysis

The WP Abstracts plugin exposes two AJAX-callable handlers, wpabstracts_load_status() and wpabstracts_delete_abstracts(), without validating a WordPress nonce token. WordPress nonces are the standard defense against CSRF and confirm that a state-changing request originated from a legitimate in-session form. Without this check, any HTTP request reaching the endpoints while an administrator holds an active session is accepted as authorized.

An attacker who lures an administrator to an attacker-controlled page can trigger these functions through auto-submitted forms or embedded requests. The impact includes unauthorized deletion of abstract records and stored content manipulation that can render as script in the admin dashboard. Full technical context is available in the Wordfence Vulnerability Analysis.

Root Cause

The root cause is the absence of check_admin_referer() or wp_verify_nonce() calls before executing sensitive operations. The vulnerable handlers are referenced in the plugin source at line 148 and line 205 of abstracts.manage.php. See the WordPress Plugin Code Review for the affected code paths.

Attack Vector

Exploitation is network-based and requires administrator interaction. The attacker crafts an HTML page containing a forged POST or GET request pointing at the vulnerable plugin endpoints. When an authenticated administrator visits the page, the browser automatically attaches session cookies, and the plugin processes the request as legitimate. Because the changed scope is affected (S:C), injected script content can execute in the administrator's browser context.

No authenticated proof-of-concept exploit code has been published for this CSRF flaw. Refer to the linked vendor advisory and source diff for exploitation details.

Detection Methods for CVE-2024-12385

Indicators of Compromise

Unexpected deletion of abstract records or manuscript entries in the WP Abstracts database tables
Administrator-initiated POST requests to admin-ajax.php with action=wpabstracts_delete_abstracts originating from external referrers
New or unexplained script content rendered within the WP Abstracts management pages
Access log entries showing cross-origin referrers immediately preceding plugin state changes

Detection Strategies

Inspect WordPress access logs for requests to wpabstracts_load_status and wpabstracts_delete_abstracts endpoints lacking a valid _wpnonce parameter
Correlate administrator session activity with off-site referrers to identify forged request patterns
Deploy a Web Application Firewall (WAF) rule that requires nonce presence on state-changing plugin AJAX actions

Monitoring Recommendations

Enable WordPress audit logging to record all administrative actions performed against the WP Abstracts plugin
Alert on bulk deletions or high-frequency invocations of the affected AJAX handlers
Monitor administrator browser sessions for unusual outbound requests following email or link interactions

How to Mitigate CVE-2024-12385

Immediate Actions Required

Upgrade the WP Abstracts plugin to a version above 2.7.2 that includes the fix from WordPress Changeset #3223874
If no patched version is deployable, deactivate and remove the plugin until remediation is available
Instruct administrators to log out of WordPress sessions before browsing untrusted content

Patch Information

The vendor addressed the vulnerability in changeset 3223874, which adds nonce validation to the affected handlers. Site operators should update through the WordPress plugin dashboard or by manually replacing the plugin files. Verify the fix by reviewing the current source at the WordPress plugin developer page.

Workarounds

Restrict access to /wp-admin/ using IP allowlisting at the web server or WAF layer
Enforce SameSite=Strict cookies on the WordPress session cookie to block cross-site request delivery
Require administrators to use dedicated browsers or profiles that do not visit untrusted sites during administrative sessions

bash

# Example WAF rule: block admin-ajax requests to vulnerable actions without a nonce
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1012385,msg:'CVE-2024-12385 CSRF block'"
  SecRule ARGS:action "@rx ^(wpabstracts_load_status|wpabstracts_delete_abstracts)$" \
    "chain"
    SecRule &ARGS:_wpnonce "@eq 0"