CVE-2024-12454: SliceWP Affiliates Plugin CSRF Vulnerability

CVE-2024-12454 Overview

CVE-2024-12454 is a Cross-Site Request Forgery (CSRF) vulnerability in the Affiliate Program Suite — SliceWP Affiliates plugin for WordPress. The flaw affects all versions up to and including 1.1.23 and stems from missing or incorrect nonce validation on a plugin function. Unauthenticated attackers can inject malicious web scripts through a forged request if they trick a site administrator into clicking a crafted link. The weakness is tracked under CWE-352.

Critical Impact
Successful exploitation lets an attacker execute administrator-context actions on a WordPress site and inject stored scripts, enabling defacement, session abuse, or persistent backdoor placement.

Affected Products

Affiliate Program Suite — SliceWP Affiliates plugin for WordPress
All plugin versions up to and including 1.1.23
WordPress sites where an administrator is authenticated and can be socially engineered

Discovery Timeline

2024-12-18 - CVE-2024-12454 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12454

Vulnerability Analysis

The vulnerability resides in the plugin's administrative settings handling code, specifically the general settings tab and the associated settings action functions referenced in the plugin source at includes/admin/settings/views/view-settings-tab-general.php and includes/admin/settings/functions-actions-settings.php. Because a request-processing function does not properly validate a WordPress nonce, the plugin trusts state-changing requests based solely on the administrator's active session cookie.

An attacker who can convince a logged-in administrator to visit an attacker-controlled page can trigger a forged request that the plugin processes as legitimate. The processed request can carry attacker-controlled input that is later rendered in the administrative interface, resulting in script injection alongside the CSRF primitive. The fix landed in changeset 3207576 and is documented in the Wordfence Vulnerability Report.

Root Cause

The root cause is missing or incorrect nonce validation on a settings-related function. WordPress relies on nonce tokens generated with wp_create_nonce() and verified with check_admin_referer() or wp_verify_nonce() to prove request intent. The affected function omits or misapplies this check, allowing cross-origin state changes.

Attack Vector

Exploitation requires user interaction from an authenticated administrator, typically clicking a link or visiting a page that auto-submits a hidden form. The request is delivered from an attacker-controlled origin and executes against the WordPress admin endpoint using the victim's session. Because script content can be injected through the same forged request, the impact extends to Cross-Site Scripting in the admin context.

No verified public exploit code is available. See the SliceWP plugin source at line 437 for the vulnerable settings view.

Detection Methods for CVE-2024-12454

Indicators of Compromise

Unexpected modifications to SliceWP plugin settings without a corresponding administrator activity log entry
Referer headers on admin.php or admin-post.php requests pointing to unknown external domains
New or altered <script> content rendered inside SliceWP admin settings pages
Outbound requests from administrator browsers to unfamiliar hosts shortly before configuration changes

Detection Strategies

Inspect web server access logs for POST requests to SliceWP settings endpoints that lack a valid _wpnonce parameter
Monitor WordPress audit trails for settings changes not correlated with an active administrator session
Alert on HTTP requests to WordPress admin URLs where the Referer header is off-site or absent

Monitoring Recommendations

Enable a WordPress activity logging plugin to track option and settings changes with user attribution
Forward WordPress and web server logs to a centralized analytics platform for correlation across sessions
Track administrator account browsing telemetry for suspicious redirect chains preceding admin panel actions

How to Mitigate CVE-2024-12454

Immediate Actions Required

Update the SliceWP Affiliates plugin to a version later than 1.1.23 that includes changeset 3207576
Audit SliceWP settings for unauthorized changes and revert any unexpected values
Force a password reset for all administrator accounts and invalidate active WordPress sessions

Patch Information

The vendor addressed the missing nonce validation in WordPress SliceWP changeset 3207576. Administrators should install the latest release from the SliceWP plugin page. Verify the installed version through the WordPress plugins dashboard after updating.

Workarounds

Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer until the plugin is updated
Deploy a Web Application Firewall rule that blocks state-changing POST requests to SliceWP endpoints missing a valid nonce
Instruct administrators to log out of WordPress before browsing untrusted content and to use a dedicated browser profile for admin tasks

bash

# Example WP-CLI commands to update the plugin and verify the installed version
wp plugin update slicewp
wp plugin get slicewp --field=version