CVE-2024-12636: WP Legal Pages Plugin CSRF Vulnerability

CVE-2024-12636 Overview

CVE-2024-12636 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Legal Pages plugin for WordPress. The plugin, marketed as a Privacy Policy Generator and Terms & Conditions Generator, is affected in all versions up to and including 3.2.6. The flaw exists because the create_popup_delete_process function lacks proper nonce validation. Unauthenticated attackers can delete popups by tricking a site administrator into clicking a crafted link. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows unauthenticated attackers to delete popup content on affected WordPress sites through forged administrator requests, resulting in integrity loss for site content.

Affected Products

WP Legal Pages (Privacy Policy Generator, Terms & Conditions Generator) WordPress plugin
All versions up to and including 3.2.6
WordPress sites with an authenticated administrator session

Discovery Timeline

2024-12-25 - CVE-2024-12636 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12636

Vulnerability Analysis

The vulnerability resides in the create_popup_delete_process function of the WP Legal Pages plugin. The function processes popup deletion requests but does not verify a valid WordPress nonce token before executing the deletion. Without nonce validation, WordPress cannot confirm that the request originated from a legitimate administrator action inside the site's admin interface.

An attacker crafts a malicious page or link that issues a request to the vulnerable endpoint. If an authenticated administrator visits the attacker-controlled resource, the browser automatically submits the administrator's session cookies alongside the forged request. The plugin then processes the deletion as if the administrator had initiated it.

The impact is limited to integrity: popup entries managed by the plugin can be removed. Confidentiality and availability are not directly affected, and the attack requires user interaction from a privileged user.

Root Cause

The root cause is missing or incorrect nonce validation on the popup deletion handler. WordPress provides wp_verify_nonce() and check_admin_referer() helpers specifically to prevent CSRF attacks on state-changing operations. The affected function omits or improperly implements these checks, allowing cross-origin requests to succeed.

Attack Vector

Exploitation follows a standard CSRF pattern. An attacker hosts a page containing an HTML form or image tag that targets the vulnerable delete endpoint on a WP Legal Pages installation. The attacker distributes the link through email, social media, or a compromised site. When a logged-in WordPress administrator loads the resource, the browser sends the request with valid authentication cookies, triggering the popup deletion. No credentials, tokens, or elevated privileges are required from the attacker.

No verified public proof-of-concept is available. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset for technical remediation details.

Detection Methods for CVE-2024-12636

Indicators of Compromise

Unexpected deletion of popup entries managed by the WP Legal Pages plugin
Administrator web sessions containing outbound referrers from untrusted domains immediately preceding popup deletion events
Requests to the plugin's popup delete endpoint lacking a valid _wpnonce parameter

Detection Strategies

Inspect web server access logs for POST or GET requests to WP Legal Pages admin-ajax or admin-post endpoints that reference create_popup_delete_process and originate from external Referer headers
Correlate WordPress audit log entries showing popup deletions against expected administrator activity windows
Alert on plugin state-change actions performed without a preceding admin panel navigation event

Monitoring Recommendations

Enable a WordPress activity logging plugin to record all plugin configuration and content changes with user attribution
Forward WordPress and web server logs to a centralized SIEM for cross-referencing referrer anomalies with administrator activity
Monitor administrator accounts for browsing sessions that immediately precede unauthorized plugin state changes

How to Mitigate CVE-2024-12636

Immediate Actions Required

Update the WP Legal Pages plugin to a version later than 3.2.6 as soon as the vendor patch is applied to your site
Audit existing popup configurations and restore any entries that appear to have been deleted without authorization
Instruct WordPress administrators to log out of admin sessions when not actively managing the site

Patch Information

The vendor addressed the missing nonce validation in the plugin repository. Review the WordPress Plugin Changeset for the code-level fix and install the latest available version of WP Legal Pages from the WordPress plugin directory. Details on affected versions and remediation guidance are provided in the Wordfence Vulnerability Analysis.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks requests to the plugin's popup delete endpoint when the Referer header does not match the site's own admin URL
Restrict WordPress administrator access using IP allowlists on /wp-admin/ to reduce exposure to opportunistic CSRF attacks
Require administrators to use isolated browser profiles or sessions dedicated to WordPress management to limit cross-site request risks

bash

# Example WAF rule concept (ModSecurity) - adjust to your environment
SecRule REQUEST_URI "@contains create_popup_delete_process" \
  "id:1012636,phase:1,deny,status:403,\
   chain,msg:'CVE-2024-12636 WP Legal Pages CSRF block'"
  SecRule &REQUEST_HEADERS:Referer "@eq 0"