CVE-2024-13317: ShipWorks Connector CSRF Vulnerability

CVE-2024-13317 Overview

CVE-2024-13317 is a Cross-Site Request Forgery (CSRF) vulnerability in the ShipWorks Connector for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 5.2.5. The plugin fails to validate nonces on the shipworks-wordpress administrative page, allowing unauthenticated attackers to submit forged requests that modify the services username and password. Exploitation requires tricking a site administrator into clicking a crafted link or visiting an attacker-controlled page. Successful abuse hijacks the shipping integration credentials used by the WooCommerce store. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Attackers can silently overwrite ShipWorks service credentials on affected WordPress sites, disrupting order fulfillment workflows and enabling credential substitution attacks against the shipping integration.

Affected Products

ShipWorks Connector for WooCommerce plugin for WordPress
All versions up to and including 5.2.5
WordPress sites running WooCommerce with the affected plugin enabled

Discovery Timeline

2025-01-18 - CVE-2024-13317 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13317

Vulnerability Analysis

The ShipWorks Connector plugin exposes an administrative settings page identified by the shipworks-wordpress slug. This page processes POST submissions that update the services username and password used to authenticate with the ShipWorks integration. The submission handler does not verify a WordPress nonce, meaning the server cannot distinguish between a legitimate administrator request and one initiated by an external origin.

An attacker who can lure an authenticated administrator to a malicious page can auto-submit a form targeting the settings endpoint. The administrator's browser attaches valid session cookies, and the plugin accepts the forged request as authentic. The confidentiality impact is none, but the integrity of the plugin configuration is directly affected, enabling downstream credential misuse.

Root Cause

The root cause is missing or incorrect nonce validation on the shipworks-wordpress settings page handler. WordPress provides wp_nonce_field() and check_admin_referer() for exactly this class of request, and neither was applied before persisting the submitted credentials. This is a textbook [CWE-352] failure in state-changing administrative functionality.

Attack Vector

Exploitation is network-based and unauthenticated from the attacker's perspective, but requires user interaction from a logged-in administrator. The attacker hosts a page containing a hidden form that POSTs to the vulnerable admin endpoint with attacker-chosen credential values. When the administrator visits the page while an active WordPress session exists, the browser silently submits the request. The plugin updates the stored ShipWorks username and password to the attacker-supplied values, potentially redirecting shipping label operations or breaking store fulfillment.

No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are available in the Wordfence Vulnerability Report and the corresponding WordPress Plugin Changeset.

Detection Methods for CVE-2024-13317

Indicators of Compromise

Unexpected changes to ShipWorks services username or password values in the WordPress wp_options table.
Administrator page views of /wp-admin/admin.php?page=shipworks-wordpress immediately followed by referrer headers pointing to external domains.
ShipWorks integration authentication failures or unexpected fulfillment errors following an administrator browsing session.

Detection Strategies

Review web server access logs for POST requests to the shipworks-wordpress admin page with off-site Referer headers.
Audit WordPress option changes for the ShipWorks credential keys and correlate with administrator activity timestamps.
Enable WordPress security plugin logging that flags administrative state changes lacking a valid nonce token.

Monitoring Recommendations

Monitor outbound requests from WooCommerce to ShipWorks endpoints for authentication anomalies.
Alert on modifications to plugin configuration options outside of change-management windows.
Track administrator session activity and cross-reference with browser telemetry that identifies visits to untrusted domains.

How to Mitigate CVE-2024-13317

Immediate Actions Required

Update the ShipWorks Connector for WooCommerce plugin to a version later than 5.2.5 as soon as a patched release is available.
Rotate the ShipWorks services username and password and verify the current stored values match expected integration credentials.
Restrict WordPress administrator accounts to dedicated browsers or sessions that do not visit untrusted external sites.

Patch Information

Refer to the WordPress Plugin Changeset for the upstream code change addressing the missing nonce validation. Site owners should upgrade to the fixed release published after version 5.2.5 and confirm the patch by reviewing the plugin's settings handler for the presence of check_admin_referer() or equivalent nonce enforcement.

Workarounds

Deactivate the ShipWorks Connector for WooCommerce plugin until a patched version can be installed.
Enforce a web application firewall rule that blocks POST submissions to the shipworks-wordpress admin page lacking a valid same-origin Referer header.
Require administrators to log out of WordPress before browsing untrusted sites, reducing the window for CSRF exploitation.

bash

# Example WAF rule concept: block cross-origin POSTs to the vulnerable admin page
# Adjust to your WAF syntax (ModSecurity example)
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1013317,msg:'Block CSRF to ShipWorks admin page'"
  SecRule REQUEST_URI "@contains /wp-admin/admin.php" "chain"
    SecRule ARGS:page "@streq shipworks-wordpress" "chain"
      SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/"