CVE-2024-13512 Overview
CVE-2024-13512 affects the Wonder FontAwesome plugin for WordPress in all versions up to and including 0.8. The vulnerability stems from missing or incorrect nonce validation on one of the plugin's functions. Unauthenticated attackers can update plugin settings and inject malicious web scripts through forged requests. Exploitation requires tricking a site administrator into clicking a crafted link or visiting a malicious page. The flaw is classified as Cross-Site Request Forgery [CWE-352] and enables stored script injection once settings are modified.
Critical Impact
Successful exploitation allows attackers to alter plugin configuration and inject persistent scripts that execute in the browsers of site visitors and administrators.
Affected Products
- Wonder FontAwesome plugin for WordPress, versions up to and including 0.8
- WordPress sites using wonderjarcreative/wonder_fontawesome
- Any WordPress installation where an administrator can be targeted with a forged request
Discovery Timeline
- 2025-01-30 - CVE-2024-13512 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13512
Vulnerability Analysis
The Wonder FontAwesome plugin exposes an administrative function that processes state-changing requests without validating a WordPress nonce. WordPress nonces exist to bind requests to an authenticated user session and prevent Cross-Site Request Forgery (CSRF). When a plugin omits wp_verify_nonce() or check_admin_referer() on a settings handler, any origin can submit a request that the target's browser will send with valid administrative cookies.
Because the affected function also writes settings that are later rendered in pages, an attacker can combine CSRF with stored Cross-Site Scripting (XSS). The forged request modifies plugin settings to include attacker-controlled markup, which the plugin then outputs without sufficient sanitization or escaping.
Root Cause
The root cause is missing or incorrect nonce validation on a privileged plugin function. The plugin trusts that any authenticated request reaching the handler is legitimate, so it never validates the request originated from a genuine WordPress admin form.
Attack Vector
Exploitation requires user interaction. An attacker crafts a page or link that submits a request to the vulnerable plugin endpoint on the target WordPress site. When a logged-in administrator visits the page, their browser silently submits the request with valid session cookies. The plugin accepts the request, updates settings, and stores any injected script payload. The payload then executes when users or administrators load pages that render the affected settings.
The vulnerability requires no authentication from the attacker, but does require action from an authenticated administrator. See the Wordfence Vulnerability Report for additional technical context.
// No verified proof-of-concept code is publicly available.
// Refer to the Wordfence advisory for technical details.
Detection Methods for CVE-2024-13512
Indicators of Compromise
- Unexpected changes to Wonder FontAwesome plugin settings in the WordPress database, particularly in wp_options entries associated with the plugin
- Presence of <script> tags or JavaScript event handlers in plugin configuration fields that should contain plain text
- Outbound requests from visitor browsers to unfamiliar third-party domains after loading pages that use FontAwesome icons
- Administrator sessions submitting POST requests to plugin endpoints without a corresponding referer from the WordPress admin dashboard
Detection Strategies
- Review WordPress access logs for POST requests to admin-ajax.php or plugin admin pages whose HTTP Referer header points to an external origin
- Audit plugin option values with wp option get for scripting content or unexpected HTML
- Correlate administrator login timestamps with plugin settings modifications recorded in security or activity plugins
Monitoring Recommendations
- Enable a WordPress activity log plugin to record settings changes with user, timestamp, and source IP
- Alert on modifications to Wonder FontAwesome option keys and on any output containing script tags rendered from plugin settings
- Monitor for administrator browser sessions initiating requests from non-WordPress origins
How to Mitigate CVE-2024-13512
Immediate Actions Required
- Update the Wonder FontAwesome plugin to a version later than 0.8 as soon as a patched release is available on the WordPress plugin repository
- Deactivate and remove the plugin if no fixed version is available and the functionality is not essential
- Review current plugin settings for injected scripts and restore known-good values
- Force administrator password resets and invalidate active sessions if tampering is suspected
Patch Information
No vendor advisory URL is listed in the CVE record. Administrators should monitor the Wonder FontAwesome plugin page and the Wordfence Vulnerability Report for release information addressing versions above 0.8.
Workarounds
- Restrict WordPress admin access to a dedicated browser profile that does not visit untrusted sites
- Deploy a Web Application Firewall (WAF) rule to require a valid WordPress nonce parameter on requests targeting the plugin's admin handlers
- Enforce a strict Content Security Policy (CSP) on WordPress admin and public pages to limit execution of injected scripts
- Limit administrator accounts to the minimum number of users required for site operations
# Example: remove the vulnerable plugin using WP-CLI
wp plugin deactivate wonder-fontawesome
wp plugin delete wonder-fontawesome
# Verify no residual settings remain
wp option list --search='wonder_fontawesome*'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.