CVE-2024-13710: Estatebud WordPress Plugin CSRF Vulnerability

CVE-2024-13710 Overview

CVE-2024-13710 is a Cross-Site Request Forgery (CSRF) vulnerability in the Estatebud – Properties & Listings plugin for WordPress. The flaw affects all versions up to and including 5.5.0. It stems from missing or incorrect nonce validation on the estatebud_settings page. Unauthenticated attackers can update the plugin's settings by tricking a site administrator into clicking a crafted link. The issue is tracked under CWE-352 and was published to the National Vulnerability Database on March 25, 2025.

Critical Impact
An attacker who successfully lures an authenticated administrator can alter plugin configuration without any credentials, compromising the integrity of property listing settings on affected WordPress sites.

Affected Products

Estatebud – Properties & Listings plugin for WordPress
All versions up to and including 5.5.0
WordPress sites with the plugin installed and active

Discovery Timeline

2025-03-25 - CVE-2024-13710 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13710

Vulnerability Analysis

The Estatebud – Properties & Listings plugin exposes an administrative settings page identified as estatebud_settings. WordPress relies on nonces (one-time tokens) to bind sensitive state-changing requests to an authenticated session. When the plugin processes updates to its settings page, it fails to verify a valid nonce or performs the check incorrectly. This allows any third-party origin to submit a request that the victim's browser will authenticate using the administrator's active session cookies. The attacker does not need credentials or prior access to the target site. The exploit requires user interaction, such as an administrator visiting an attacker-controlled page or clicking a malicious link while logged in.

Root Cause

The root cause is missing or improperly implemented nonce validation on the plugin's settings handler. WordPress provides wp_verify_nonce() and check_admin_referer() helpers precisely to prevent this class of forgery. Their absence on the estatebud_settings request handler leaves the endpoint reachable via any authenticated cross-origin request. This maps to CWE-352: Cross-Site Request Forgery.

Attack Vector

Exploitation is network-based and requires administrator interaction. The attacker hosts a page containing an auto-submitting HTML form or image tag that issues a POST or GET request to the vulnerable plugin endpoint on the target WordPress site. When the logged-in administrator loads the attacker's content, the browser attaches the WordPress session cookie and the plugin processes the forged settings update. Confidentiality is not directly affected, but integrity of the plugin configuration is compromised.

No verified public proof-of-concept code has been published. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-13710

Indicators of Compromise

Unexpected modifications to Estatebud plugin settings that no administrator recalls making
HTTP POST requests to the estatebud_settings administrative page originating from external Referer headers
Administrator sessions submitting settings updates immediately after visiting third-party domains
Web server access logs showing settings updates without corresponding admin dashboard navigation events

Detection Strategies

Monitor WordPress audit logs for changes to Estatebud plugin configuration and correlate with administrator browsing activity
Inspect HTTP request headers for Referer values pointing to external domains on requests targeting wp-admin settings endpoints
Deploy a web application firewall (WAF) rule that flags state-changing requests to the plugin lacking a valid WordPress nonce parameter
Establish a baseline of expected administrator activity and alert on deviations tied to plugin configuration endpoints

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture all settings changes with user, timestamp, and source IP
Forward web server and WordPress logs to a centralized SIEM for correlation across administrator sessions
Review plugin configuration weekly against a known-good baseline
Alert on any administrative POST request whose Referer header does not originate from the site's own domain

How to Mitigate CVE-2024-13710

Immediate Actions Required

Update the Estatebud – Properties & Listings plugin to a version later than 5.5.0 as soon as a patched release is available from the plugin repository
Deactivate and remove the plugin if a patched version is not yet available and it is not business-critical
Instruct administrators to log out of WordPress before browsing untrusted sites and to use a dedicated browser profile for administrative work
Audit current plugin settings against a known-good configuration and revert any unauthorized changes

Patch Information

The vulnerability affects all versions up to and including 5.5.0. Site owners should monitor the official plugin listing on WordPress.org and the Wordfence advisory for release notes indicating the fixed version. Apply the update through the WordPress plugin management console once available.

Workarounds

Restrict access to /wp-admin/ by source IP address at the web server or WAF layer
Enforce SameSite=Strict on the WordPress session cookie to block cross-origin cookie transmission
Deploy a WAF rule that requires a valid _wpnonce parameter on POST requests targeting the plugin's settings endpoint
Require re-authentication for administrator accounts on a short interval to shrink the window for CSRF exploitation

bash

# Example nginx snippet: block cross-origin POSTs to wp-admin lacking a same-origin Referer
location ~ ^/wp-admin/.*\.php$ {
    if ($request_method = POST) {
        set $csrf_check "";
        if ($http_referer !~* "^https?://your-domain\.example/") {
            set $csrf_check "block";
        }
        if ($csrf_check = "block") {
            return 403;
        }
    }
}