CVE-2024-13753 Overview
CVE-2024-13753 is a Cross-Site Request Forgery (CSRF) vulnerability in the Ultimate Classified Listings plugin for WordPress, developed by webcodingplace. The flaw affects all versions up to and including 1.5, and stems from missing or incorrect nonce validation in the update_profile function. Unauthenticated attackers can modify a victim's email address via a forged request, which can lead to full account takeover when paired with password reset workflows. Exploitation requires the attacker to trick an authenticated user into clicking a crafted link or visiting a malicious page. The vulnerability is tracked under CWE-352.
Critical Impact
Successful exploitation allows unauthenticated attackers to hijack WordPress user accounts by replacing the registered email address and triggering a password reset.
Affected Products
- Webcodingplace Ultimate Classified Listings plugin for WordPress versions 1.0 through 1.5
- WordPress sites running the ultimate-classified-listings plugin with vulnerable class-shortcodes.php
- Any WordPress installation where the plugin's profile update shortcode is exposed to authenticated users
Discovery Timeline
- 2025-02-20 - CVE-2024-13753 published to the National Vulnerability Database
- 2026-04-08 - Last updated in NVD database
Technical Details for CVE-2024-13753
Vulnerability Analysis
The vulnerability resides in the update_profile function inside the plugin's classes/class-shortcodes.php file. The function processes profile update requests, including email address changes, but does not verify a WordPress nonce token before applying changes. Without this token, the server cannot distinguish between a legitimate form submission and a request forged by an external site. An attacker who lures an authenticated victim to a malicious page can submit a hidden form to the WordPress site under the victim's session. The forged request changes the victim's email address to one controlled by the attacker. The attacker then initiates a password reset through standard WordPress flows and receives the reset link at the attacker-controlled inbox.
Root Cause
The root cause is a missing call to WordPress nonce validation primitives such as wp_verify_nonce() or check_admin_referer() within the update_profile handler. CSRF protections rely on a per-session, per-action token that attackers cannot predict. The plugin accepts state-changing POST data without validating origin, intent, or token freshness, which is the canonical pattern for CWE-352.
Attack Vector
The attack is network-based and requires user interaction. An attacker hosts a page containing an auto-submitting HTML form or XMLHttpRequest targeting the victim's WordPress site. When an authenticated user visits the page, the browser attaches the WordPress session cookie to the cross-origin request. The vulnerable update_profile endpoint accepts the request and rewrites the user's email field. No authentication credentials or technical knowledge of the victim's account are required beyond the target URL. Refer to the Wordfence Vulnerability Analysis and the WordPress Class Shortcodes File for technical details.
Detection Methods for CVE-2024-13753
Indicators of Compromise
- Unexpected changes to user email addresses in the wp_users table without corresponding profile activity in audit logs
- Password reset emails delivered to addresses that do not match historical user records
- HTTP POST requests to profile update endpoints with Referer or Origin headers pointing to external domains
- Login sessions originating from new geographic locations immediately after an email change event
Detection Strategies
- Monitor WordPress database changes to the user_email column and correlate against authenticated session origins
- Inspect web server access logs for POST requests to the plugin's shortcode handlers lacking a valid _wpnonce parameter
- Deploy a Web Application Firewall (WAF) rule that flags cross-origin POST requests to WordPress profile endpoints
Monitoring Recommendations
- Enable WordPress audit logging plugins to record every user profile modification with timestamps and source IP
- Alert on password reset requests that follow an email change within a short time window
- Track plugin version inventory across WordPress fleets to identify hosts still running Ultimate Classified Listings 1.5 or earlier
How to Mitigate CVE-2024-13753
Immediate Actions Required
- Update the Ultimate Classified Listings plugin to version 1.6 or later, which adds nonce validation to the update_profile function
- Audit existing WordPress user accounts for unauthorized email changes and force password resets where anomalies are found
- Inform users of the site to avoid clicking unsolicited links while authenticated to the WordPress dashboard
Patch Information
The vendor released a fix in version 1.6 of the plugin. The remediation is documented in the WordPress Changeset Update, which introduces nonce verification before processing profile updates. Site administrators should apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Disable the Ultimate Classified Listings plugin until the patch is applied if immediate upgrade is not possible
- Restrict access to profile update shortcodes via WAF rules that require a valid Referer header matching the site's domain
- Apply SameSite cookie attributes to the WordPress session cookie to limit cross-origin cookie attachment
# Update the plugin via WP-CLI
wp plugin update ultimate-classified-listings --version=1.6
# Verify installed version
wp plugin get ultimate-classified-listings --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
