CVE-2024-1362 Overview
The Colibri Page Builder plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 1.0.253. The flaw resides in the cp_shortcode_refresh() function, which lacks proper nonce validation. Unauthenticated attackers can execute arbitrary shortcodes on a target site by tricking an administrator into clicking a crafted link. Exploitation requires user interaction but no authentication on the attacker's side. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery and impacts sites running the plugin from vendor Extendthemes.
Critical Impact
Unauthenticated attackers can execute arbitrary WordPress shortcodes against a targeted administrator, potentially rendering unauthorized content or triggering plugin-provided functionality.
Affected Products
- Extendthemes Colibri Page Builder for WordPress
- All plugin versions up to and including 1.0.253
- WordPress installations with the vulnerable plugin active
Discovery Timeline
- 2024-02-23 - CVE-2024-1362 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1362
Vulnerability Analysis
The Colibri Page Builder plugin exposes the cp_shortcode_refresh() function without adequate request origin verification. WordPress plugins typically use nonces to confirm that a state-changing request originated from a legitimate user session. The missing or incorrect nonce check in this handler allows a remote attacker to forge requests that the plugin processes as if they came from an authenticated administrator. The handler renders shortcodes, so an attacker controls which shortcode executes and what parameters it receives. The impact is limited to shortcode execution rather than full code execution, but shortcodes bundled with themes or other plugins may expose additional functionality that expands the effective attack surface.
Root Cause
The root cause is a missing or improperly implemented nonce validation check in the cp_shortcode_refresh() function inside src/PageBuilder.php. Without server-side verification of the _wpnonce token, the plugin cannot distinguish between legitimate administrator actions and forged cross-origin requests. The vendor patched this issue in changeset 3039597 by adding the required nonce validation before executing the shortcode logic.
Attack Vector
Exploitation proceeds over the network and depends on social engineering. An attacker crafts a malicious webpage or email containing a link or auto-submitting form that targets the vulnerable endpoint on the victim WordPress site. When an authenticated administrator visits the attacker-controlled resource, the browser sends the forged request along with the administrator's session cookies. The plugin processes the request, calls cp_shortcode_refresh(), and executes the attacker-supplied shortcode in the administrator's context. See the Wordfence Vulnerability Report for additional technical context.
No verified proof-of-concept code is publicly available for this vulnerability. The exploitation pattern follows the standard CSRF model: a forged HTTP request to the plugin's shortcode refresh endpoint that omits or supplies an invalid nonce parameter.
Detection Methods for CVE-2024-1362
Indicators of Compromise
- Unexpected POST or GET requests targeting the cp_shortcode_refresh endpoint from external referrers
- Web server access logs showing requests to the plugin without a valid _wpnonce parameter
- Unusual shortcode execution or content rendering events attributed to administrator sessions
- Referer headers pointing to unknown external domains preceding plugin activity
Detection Strategies
- Inspect WordPress access logs for requests to admin-ajax.php or plugin endpoints invoking cp_shortcode_refresh with missing or malformed nonces
- Enable a web application firewall (WAF) rule set that flags cross-origin requests to WordPress administrative endpoints
- Monitor for administrator sessions triggering shortcode operations immediately after clicking outbound links
Monitoring Recommendations
- Aggregate WordPress and web server logs into a centralized SIEM for correlation across administrator activity
- Alert on outbound HTTP requests originating from administrator browsers to newly seen or low-reputation domains
- Track plugin version inventory across all WordPress instances and flag hosts running Colibri Page Builder 1.0.253 or earlier
How to Mitigate CVE-2024-1362
Immediate Actions Required
- Update Colibri Page Builder to a version later than 1.0.253 that incorporates changeset 3039597
- Audit administrator accounts and revoke sessions if suspicious shortcode activity is observed
- Restrict administrator browsing habits and enforce use of separate browsers or profiles for WordPress administration
Patch Information
The vendor addressed the vulnerability in the plugin source through WordPress Plugin Trac Changeset 3039597, which introduces proper nonce validation in cp_shortcode_refresh(). Site administrators should upgrade to the fixed release available through the WordPress plugin repository.
Workarounds
- Deactivate the Colibri Page Builder plugin until the patched version can be installed
- Deploy a WAF rule that blocks requests to the plugin endpoint lacking a valid _wpnonce token
- Require administrators to authenticate through a dedicated browser profile with strict same-site cookie enforcement
# Update Colibri Page Builder via WP-CLI
wp plugin update colibri-page-builder
# Verify installed version is patched
wp plugin get colibri-page-builder --field=version
# Deactivate as a temporary workaround if patching is delayed
wp plugin deactivate colibri-page-builder
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
