CVE-2024-1361: Colibri Page Builder CSRF Vulnerability

CVE-2024-1361 Overview

The Colibri Page Builder plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 1.0.253. The flaw resides in the apiCall() function, which lacks proper nonce validation. Unauthenticated attackers can trigger a limited set of plugin functions by tricking an authenticated administrator into clicking a crafted link. Exploitable actions include importing images, deleting posts, and saving theme data. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation lets remote attackers modify theme data, delete posts, and import arbitrary images on WordPress sites by abusing an administrator's authenticated session.

Affected Products

Extendthemes Colibri Page Builder for WordPress — all versions through 1.0.253
WordPress sites with the Colibri Page Builder plugin installed and active
Sites where administrators access the WordPress dashboard in a browser with other tabs open

Discovery Timeline

2024-02-23 - CVE-2024-1361 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1361

Vulnerability Analysis

The Colibri Page Builder plugin exposes an administrative API endpoint handled by the apiCall() function in extend-builder/api/api.php. This endpoint processes privileged plugin operations but does not verify a WordPress nonce or any equivalent anti-CSRF token. As a result, requests originating from third-party domains are processed as long as the victim's browser carries a valid administrator session cookie.

The impact is bounded by the subset of functions reachable through the vulnerable endpoint. Exposed operations include importing remote images into the media library, deleting existing posts, and persisting theme configuration data. An attacker cannot execute arbitrary PHP directly, but can modify site content, corrupt theme state, or seed imported media that may be leveraged in follow-on attacks. User interaction is required, which caps the overall severity.

Root Cause

The root cause is missing or incorrect nonce validation inside the plugin's apiCall() dispatcher. WordPress provides wp_verify_nonce() and check_admin_referer() specifically to defeat CSRF against authenticated administrative actions. The affected code path did not invoke these checks before dispatching to privileged sub-handlers.

Attack Vector

Exploitation requires an attacker to lure a logged-in site administrator to a malicious page or crafted link. The malicious page issues a cross-origin request (via a hidden form submission or image tag) to the vulnerable WordPress endpoint. The browser attaches the administrator's session cookies, and the plugin executes the chosen action under the administrator's identity.

No authenticated exploit code or public proof-of-concept has been published. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-1361

Indicators of Compromise

Unexpected entries in the WordPress media library imported from unknown remote URLs
Posts missing from the site that were not deleted by an administrator
Theme or page builder configuration changes with no corresponding admin login activity
HTTP referer headers from external domains in access logs for requests targeting the Colibri plugin's API endpoint

Detection Strategies

Review web server logs for POST requests to extend-builder/api/api.php where the Referer header does not match the site's own origin
Correlate administrator session activity timestamps against post deletion and media import events in the WordPress audit log
Alert on bursts of media imports or post deletions that occur outside normal administrative workflows

Monitoring Recommendations

Enable a WordPress audit logging plugin to record post deletions, media uploads, and theme option changes with associated user and IP metadata
Monitor plugin version inventory to detect sites still running Colibri Page Builder 1.0.253 or earlier
Watch for anomalous outbound requests from the WordPress server triggered by remote image import operations

How to Mitigate CVE-2024-1361

Immediate Actions Required

Update Colibri Page Builder to a version later than 1.0.253 that contains the nonce validation fix referenced in the WordPress Plugin Changeset
Audit recent post deletions, media imports, and theme changes for signs of unauthorized modification
Rotate administrator credentials if evidence of unauthorized actions is identified

Patch Information

The vendor addressed the issue in the Colibri Page Builder repository under changeset 3039597, which adds nonce validation to the apiCall() function. Site owners should install the patched plugin version through the WordPress admin dashboard or by replacing the plugin files directly. Full details are documented in the vendor changeset.

Workarounds

Deactivate the Colibri Page Builder plugin until the patched version is installed
Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer to reduce exposure of administrator sessions
Require administrators to use a dedicated browser or profile for WordPress management, limiting cross-site request exposure
Deploy a web application firewall rule that blocks requests to the Colibri API endpoint when the Referer or Origin header does not match the site domain

bash

# Example nginx configuration to block cross-origin requests to the plugin API
location ~ /wp-content/plugins/colibri-page-builder/extend-builder/api/api\.php$ {
    valid_referers server_names;
    if ($invalid_referer) {
        return 403;
    }
}