CVE-2024-12414 Overview
The Themify Store Locator plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 1.1.9. The flaw stems from missing or incorrect nonce validation on the setting_page() function within the plugin's initialization logic. Unauthenticated attackers can forge requests that modify the plugin's settings when a site administrator is tricked into clicking a crafted link. The vulnerability is tracked under CWE-352 and requires user interaction to succeed.
Critical Impact
An attacker who successfully lures an authenticated administrator into visiting a malicious page can alter Store Locator plugin settings without consent, undermining site configuration integrity.
Affected Products
- Themify Store Locator plugin for WordPress, all versions through 1.1.9
- WordPress sites using the vulnerable themify:store_locator component
- Deployments matching CPE cpe:2.3:a:themify:store_locator:*:*:*:*:*:wordpress:*:*
Discovery Timeline
- 2024-12-13 - CVE-2024-12414 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12414
Vulnerability Analysis
The Themify Store Locator plugin exposes an administrative settings handler through the setting_page() function defined in includes/init.php. WordPress plugins are expected to protect state-changing administrative actions with a nonce token verified by check_admin_referer() or wp_verify_nonce(). In vulnerable releases, this validation is missing or incorrect, so the handler accepts POST or GET requests solely based on the presence of an authenticated administrator session.
Because browsers automatically attach WordPress authentication cookies to same-origin requests, an attacker can host an external page that submits a form or issues a request to the plugin's settings endpoint. When an administrator visits that page while logged in, the browser replays the session and the settings mutation succeeds. Impact is limited to integrity of plugin configuration; the flaw does not directly expose data or enable code execution.
Root Cause
The root cause is absent CSRF protection on a privileged handler. The setting_page() function processes configuration updates without verifying a request-scoped nonce or validating the HTTP Referer, violating the WordPress security model for administrative actions.
Attack Vector
Exploitation requires a network-reachable WordPress installation and a targeted administrator who is tricked into loading attacker-controlled content. The attacker crafts an HTML page containing an auto-submitting form or image tag pointing at the plugin's settings URL with attacker-chosen parameters. When the administrator visits the page, the forged request executes with their privileges and modifies the plugin's configuration.
Refer to the WordPress plugin source at line 142 of init.php and the Wordfence vulnerability report for the technical breakdown.
Detection Methods for CVE-2024-12414
Indicators of Compromise
- Unexpected changes to Themify Store Locator plugin settings, including modified store data, map API keys, or display options.
- Administrator web sessions containing POST or GET requests to the plugin's settings handler that lack a valid _wpnonce parameter.
- HTTP Referer headers on plugin settings requests pointing to external, untrusted origins.
Detection Strategies
- Inspect WordPress access logs for requests to wp-admin endpoints associated with themify-store-locator that originate cross-site or omit nonce tokens.
- Enable WordPress audit logging plugins to capture plugin configuration changes and correlate them with administrator browsing activity.
- Compare running plugin versions against 1.1.9 and flag any installation at or below that version as vulnerable.
Monitoring Recommendations
- Monitor administrator accounts for suspicious outbound navigation events preceding plugin option changes.
- Alert on modifications to WordPress wp_options rows related to the Store Locator plugin outside of scheduled maintenance windows.
- Track EPSS trend data (currently 0.207%) for shifts that may indicate emerging exploitation interest.
How to Mitigate CVE-2024-12414
Immediate Actions Required
- Update the Themify Store Locator plugin to a version later than 1.1.9 as soon as the vendor publishes a fixed release.
- Audit plugin settings for unauthorized modifications and restore known-good values where necessary.
- Instruct WordPress administrators to log out of admin sessions before browsing untrusted sites and to use a dedicated browser profile for site administration.
Patch Information
Remediation is tracked in the vendor's WordPress plugin changeset, which introduces nonce validation on the setting_page() handler. Administrators should apply the update through the WordPress plugin dashboard and confirm the installed version reflects the corrected build.
Workarounds
- Deactivate the Themify Store Locator plugin until the patched version can be installed.
- Deploy a Web Application Firewall (WAF) rule that blocks requests to the plugin's settings endpoint lacking a valid _wpnonce parameter or with an external Referer.
- Restrict wp-admin access to trusted IP ranges via web server or reverse-proxy access controls to reduce exposure to CSRF lures.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
