CVE-2024-13444: wp-greet WordPress Plugin CSRF Vulnerability

CVE-2024-13444 Overview

The wp-greet plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 6.2. The flaw exists because a plugin function lacks proper nonce validation, allowing unauthenticated attackers to submit forged requests that update plugin settings. A successful attack requires tricking a site administrator into clicking a malicious link while authenticated. Attackers can leverage the settings update path to inject malicious web scripts, chaining CSRF into a stored Cross-Site Scripting (XSS) condition. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker who successfully lures an administrator into clicking a crafted link can modify wp-greet plugin settings and inject arbitrary JavaScript that executes in the context of any user visiting the affected WordPress site.

Affected Products

WordPress wp-greet plugin, all versions up to and including 6.2
WordPress sites where an administrator can be socially engineered into clicking a crafted link
Public-facing WordPress installations serving greeting or guestbook functionality via wp-greet

Discovery Timeline

2025-01-21 - CVE-2024-13444 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-13444

Vulnerability Analysis

The vulnerability resides in the administrative and form-handling code paths of the wp-greet plugin. Specifically, request handlers in wpg-admin.php and wpg-form.php process state-changing operations without verifying a WordPress nonce token. WordPress relies on nonces as anti-CSRF tokens, tying a request to a specific user session and action. Without this validation, any HTTP request that reaches the vulnerable handler while an administrator is authenticated is processed as legitimate. The referenced code locations are wpg-admin.php line 124, wpg-admin.php line 350, and wpg-form.php line 253, as documented in the WordPress plugin source browser and the Wordfence Vulnerability Report.

Root Cause

The root cause is missing or incorrect nonce validation. The plugin functions do not call check_admin_referer() or wp_verify_nonce() before applying setting changes. Because the plugin also fails to sanitize or escape the values it stores, an attacker-supplied payload can include HTML or JavaScript that is later rendered on plugin-controlled pages.

Attack Vector

The attack is remote and requires user interaction from a site administrator. An attacker hosts a page containing an auto-submitting form or an image tag targeting the vulnerable plugin endpoint. When the authenticated administrator visits the attacker-controlled resource, the browser transmits session cookies alongside the forged request. The plugin accepts the request and updates the stored settings with attacker-controlled content, enabling a persistent script injection that affects subsequent site visitors.

// No verified proof-of-concept code has been published for CVE-2024-13444.
// The vulnerability mechanism is described in prose above. See the
// Wordfence Vulnerability Report and the WordPress ChangeSet #3225035
// for the corrected nonce-validation logic.

Detection Methods for CVE-2024-13444

Indicators of Compromise

Unexpected modifications to wp-greet plugin settings recorded in the WordPress wp_options table or in plugin-specific storage.
Presence of <script> tags, event handlers such as onerror= or onload=, or obfuscated JavaScript inside wp-greet configuration values.
Outbound requests from site visitors to unfamiliar domains sourced from pages rendered by the plugin.

Detection Strategies

Inspect HTTP access logs for POST requests to wpg-admin.php or wpg-form.php where the Referer header points to an external domain rather than /wp-admin/.
Search plugin configuration values for HTML, JavaScript, or encoded payloads that should not appear in greeting content.
Correlate administrator authentication events with subsequent settings changes to identify anomalous timing patterns consistent with CSRF.

Monitoring Recommendations

Enable WordPress audit logging for options updates and administrator activity, and forward events to a central SIEM for correlation.
Monitor for browser console errors and Content Security Policy (CSP) violations reported by visitors, which often surface injected scripts.
Alert on any modification to wp-greet settings outside of scheduled maintenance windows.

How to Mitigate CVE-2024-13444

Immediate Actions Required

Update the wp-greet plugin to a version that includes the fix applied in WordPress ChangeSet #3225035.
Audit existing wp-greet configuration values and remove any HTML or JavaScript content that was not authored by a site administrator.
Invalidate active administrator sessions and rotate credentials if evidence of unauthorized settings changes exists.

Patch Information

The vendor addressed the vulnerability in the changeset published on the WordPress plugin repository. Details are available on the WordPress Plugin Developer Page and in the Wordfence Vulnerability Report. Administrators should apply the latest available release rather than backporting individual functions.

Workarounds

If patching is not immediately possible, deactivate and remove the wp-greet plugin until the update can be applied.
Restrict administrative access to a dedicated browser profile that is not used for general web browsing, reducing the likelihood of successful CSRF lures.
Deploy a Web Application Firewall (WAF) rule that enforces same-origin Referer and Origin headers on POST requests targeting wpg-admin.php and wpg-form.php.

bash

# Example: verify installed wp-greet version and remove the plugin
# if the site cannot be patched immediately (requires WP-CLI).
wp plugin get wp-greet --field=version
wp plugin deactivate wp-greet
wp plugin delete wp-greet