CVE-2024-13337 Overview
CVE-2024-13337 affects the Clearfy Cache WordPress plugin, a popular optimization tool that provides HTML, CSS, and JavaScript minification along with script deferral capabilities. The vulnerability is a Cross-Site Request Forgery (CSRF) flaw [CWE-352] in the setup-wbcr_clearfy page caused by missing or incorrect nonce validation. All versions up to and including 2.3.2 are affected. An unauthenticated attacker can modify plugin settings by tricking a site administrator into clicking a crafted link or visiting a malicious page.
Critical Impact
Successful exploitation allows attackers to alter Clearfy plugin settings on a target WordPress site through forged requests, impacting site integrity without requiring authentication from the attacker.
Affected Products
- Clearfy Cache plugin for WordPress — all versions up to and including 2.3.2
- Vendor: cm-wp
- CPE: cpe:2.3:a:cm-wp:clearfy:*:*:*:*:*:wordpress:*:*
Discovery Timeline
- 2025-04-12 - CVE-2024-13337 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13337
Vulnerability Analysis
The Clearfy Cache plugin exposes a setup page identified as setup-wbcr_clearfy that processes administrative configuration changes. The handler for this page does not validate a WordPress nonce before applying submitted settings. Without nonce validation, the server cannot verify that the request originated from a legitimate administrator session on the WordPress dashboard. An attacker crafts an HTML page containing a form or image tag that submits a POST or GET request to the vulnerable endpoint. If a logged-in administrator visits that page, the browser automatically includes session cookies, and the plugin processes the request as authentic.
The impact is limited to integrity of plugin settings. Confidentiality and availability are not directly affected. However, altered caching, minification, or defer settings can indirectly degrade site behavior or create conditions for follow-on attacks against site content delivery.
Root Cause
The root cause is missing or incorrect use of WordPress nonce validation (wp_verify_nonce or check_admin_referer) in the setup form handler located under libs/factory/templates/pages/setup-parts/class-step-form.php. Without this check, the plugin trusts any authenticated request reaching the endpoint, regardless of origin.
Attack Vector
Exploitation requires user interaction from a privileged administrator. The attacker hosts or delivers a malicious page containing a forged request targeting the Clearfy setup endpoint. When the administrator loads the page while authenticated to WordPress, the browser submits the request with valid session cookies, and the plugin applies the attacker-controlled settings. No code execution is produced on the WordPress server itself, but configuration tampering persists until manually reverted.
No verified public exploit code is available. Technical details are documented in the Wordfence Vulnerability Analysis and the vendor patch is published in the WordPress Trac Changeset for Clearfy.
Detection Methods for CVE-2024-13337
Indicators of Compromise
- Unexpected changes to Clearfy plugin configuration in wp_options table entries related to wbcr_clearfy settings
- WordPress access logs showing POST requests to admin.php?page=setup-wbcr_clearfy with external HTTP Referer headers
- Administrator session activity correlating with recent visits to unknown external sites
Detection Strategies
- Review web server logs for requests to the setup-wbcr_clearfy endpoint that lack an on-site Referer header or arrive from unexpected origins
- Monitor WordPress audit trails for unauthorized modifications to plugin options and settings
- Compare current Clearfy configuration against known-good baselines to detect silent tampering
Monitoring Recommendations
- Enable a WordPress security plugin or activity log that records option changes with user attribution and source IP
- Alert on administrative setting changes that occur outside of normal maintenance windows
- Track installed plugin versions across the environment to confirm Clearfy is updated past 2.3.2
How to Mitigate CVE-2024-13337
Immediate Actions Required
- Update the Clearfy Cache plugin to the latest version that contains the fix referenced in WordPress Trac Changeset 3268278
- Audit current Clearfy settings against a known-good configuration and revert any unauthorized changes
- Instruct administrators to log out of WordPress when not actively managing the site
Patch Information
The vendor addressed the issue in the Clearfy plugin by adding proper nonce validation to the setup form handler in libs/factory/templates/pages/setup-parts/class-step-form.php. Site operators should upgrade to a version later than 2.3.2 as published in the official WordPress plugin repository. Refer to the Wordfence Vulnerability Analysis for additional context on the fix.
Workarounds
- Deactivate the Clearfy Cache plugin until the patched version is applied if immediate updates are not possible
- Deploy a Web Application Firewall rule to block requests to admin.php?page=setup-wbcr_clearfy that lack a same-origin Referer header
- Restrict administrative dashboard access to specific source IP ranges using server-level controls
- Require administrators to use isolated browser sessions or dedicated browsers for WordPress management to reduce CSRF exposure
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
