CVE-2024-1339: ImageRecycle Plugin CSRF Vulnerability

CVE-2024-1339 Overview

CVE-2024-1339 is a Cross-Site Request Forgery (CSRF) vulnerability in the ImageRecycle pdf & image compression plugin for WordPress. The flaw affects all versions up to and including 3.1.13. The plugin's reinitialize function lacks proper nonce validation, allowing unauthenticated attackers to craft forged requests. When a site administrator is tricked into clicking a malicious link, the request removes all plugin data. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation lets unauthenticated attackers wipe all plugin data on affected WordPress sites through social engineering of an authenticated administrator.

Affected Products

ImageRecycle pdf & image compression plugin for WordPress, versions ≤ 3.1.13
WordPress sites with the plugin installed and active
Administrator accounts targeted via crafted links or embedded content

Discovery Timeline

2024-02-29 - CVE-2024-1339 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1339

Vulnerability Analysis

The vulnerability originates in the plugin's reinitialize function, which handles resetting or removing plugin data. WordPress plugins should validate a nonce token on state-changing requests using functions such as wp_verify_nonce() or check_admin_referer(). The ImageRecycle plugin omits or incorrectly implements this validation on the reinitialize action. As a result, the server cannot distinguish between a legitimate administrator request and one forged by an external site.

An attacker crafts a page or link containing a request to the vulnerable endpoint. When an authenticated administrator visits the attacker-controlled resource, the browser automatically sends valid session cookies. The plugin processes the request as if the administrator initiated it, executing the reinitialize routine and deleting plugin data.

The attack requires user interaction from a privileged user but does not require the attacker to hold any credentials on the target site.

Root Cause

The root cause is missing or incorrect anti-CSRF token validation on a privileged state-changing endpoint [CWE-352]. WordPress provides a nonce mechanism specifically to prevent these forgeries, but the reinitialize handler in versions ≤ 3.1.13 does not enforce it.

Attack Vector

Exploitation occurs over the network and requires an administrator to interact with attacker-controlled content, such as a phishing email link, a malicious website, or a forum post containing an image tag or auto-submitting form. No prior authentication on the target site is required by the attacker. The impact is limited to integrity, with loss of plugin data and configuration on the affected site.

No verified public proof-of-concept code is available for this issue. Technical details are referenced in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-1339

Indicators of Compromise

Unexpected deletion or reset of ImageRecycle plugin configuration and stored data
Administrator-initiated requests to the plugin's reinitialize endpoint with Referer headers pointing to external domains
Access log entries showing POST or GET requests to the plugin action originating from unusual referrers

Detection Strategies

Inspect web server access logs for requests to ImageRecycle plugin endpoints that carry cross-origin Referer or Origin headers
Monitor WordPress audit logs for plugin data reset events not correlated with administrator activity in the admin UI
Deploy a Web Application Firewall (WAF) rule to flag state-changing requests to plugin endpoints missing a valid nonce parameter

Monitoring Recommendations

Enable WordPress activity logging plugins to capture administrator actions and plugin configuration changes
Alert on abnormal reductions in plugin database tables or option rows tied to ImageRecycle
Track outbound clicks and inbound referrers to WordPress admin URLs to identify social engineering campaigns

How to Mitigate CVE-2024-1339

Immediate Actions Required

Update the ImageRecycle pdf & image compression plugin to a version later than 3.1.13
Audit administrator accounts and enforce multi-factor authentication to reduce the impact of session hijacking scenarios
Instruct administrators to log out of WordPress sessions when not actively managing the site

Patch Information

The vendor released a fix documented in the WordPress Plugin Changeset 3031424. The patch adds nonce validation to the reinitialize function. Site owners should update through the WordPress plugin dashboard or by manually deploying the patched release. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Deactivate and remove the ImageRecycle plugin until an update can be applied
Restrict WordPress admin access by source IP through web server configuration or a WAF
Configure a WAF rule to block requests to the vulnerable plugin action that lack a WordPress nonce parameter

bash

# Example WAF rule concept (ModSecurity syntax)
SecRule REQUEST_URI "@contains imagerecycle" \
  "chain,deny,status:403,id:1003390,msg:'Block ImageRecycle reinitialize without nonce'"
  SecRule &ARGS:_wpnonce "@eq 0"