CVE-2024-13774: WPFactory Wishlist CSRF Vulnerability

CVE-2024-13774 Overview

The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 3.1.7. The flaw exists in the save_to_multiple_wishlist function due to missing or incorrect nonce validation. Unauthenticated attackers can update plugin settings and inject malicious web scripts by tricking a site administrator into clicking a crafted link. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows attackers to modify plugin settings and inject persistent scripts into WooCommerce stores, enabling downstream attacks against administrators and customers.

Affected Products

WPFactory Wishlist for WooCommerce: Multi Wishlists Per Customer (WordPress plugin)
All versions up to and including 3.1.7
Sites using the vulnerable save_to_multiple_wishlist AJAX handler

Discovery Timeline

2025-03-08 - CVE-2024-13774 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13774

Vulnerability Analysis

The plugin exposes an AJAX endpoint that handles wishlist save operations across multiple customer wishlists. The handler processes state-changing requests without verifying an anti-CSRF nonce, which WordPress provides through wp_verify_nonce() and related helpers. Because the endpoint accepts requests without validating request origin, an attacker-hosted page can silently submit a forged POST or GET request that executes with the victim administrator's session cookies.

Once the request reaches the vulnerable handler, the attacker controls parameters that persist to plugin settings. Injected content can include HTML and JavaScript that renders in the store's front-end or admin views, escalating a CSRF flaw into stored Cross-Site Scripting (XSS). The impact is limited to integrity, but a compromised administrator account can pivot to full site takeover.

Root Cause

The root cause is missing nonce validation in the save_to_multiple_wishlist function inside includes/free/class-alg-wc-wish-list-ajax.php. The handler processes user-supplied data without invoking check_ajax_referer() or an equivalent nonce check, violating WordPress security guidance for AJAX endpoints. Vulnerable code locations are documented at line 337 and line 789.

Attack Vector

Exploitation requires no authentication but does require user interaction from a site administrator. The attacker crafts a malicious page or email link that triggers a background request to the WordPress admin-ajax endpoint. When the administrator visits the page while authenticated to WordPress, the browser attaches session cookies and the forged request executes with administrator privileges. The attacker then persists arbitrary settings or script payloads through the plugin. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-13774

Indicators of Compromise

Unexpected changes to Wishlist for WooCommerce plugin settings in wp_options
Requests to admin-ajax.php with action=save_to_multiple_wishlist originating from external referrers
Presence of <script> tags or HTML markup in wishlist-related option values or metadata
New or modified administrator activity following a click on an external link

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php where the Referer header points to third-party domains
Audit the plugin's option keys and post meta for injected HTML or JavaScript payloads
Compare installed plugin version against the fixed release 3.1.8 or later
Correlate administrator session activity with settings modification events

Monitoring Recommendations

Enable request logging on WordPress admin endpoints and forward to a centralized log platform
Alert on writes to plugin option keys performed outside of the WordPress admin interface
Monitor for anomalous outbound requests from browsers rendering WooCommerce pages, which may indicate injected scripts

How to Mitigate CVE-2024-13774

Immediate Actions Required

Update the Wishlist for WooCommerce: Multi Wishlists Per Customer plugin to version 3.1.8 or later
Review plugin settings and wishlist configuration for unauthorized changes
Force administrator password resets and invalidate active WordPress sessions if compromise is suspected
Scan front-end pages for injected scripts and remove malicious payloads

Patch Information

WPFactory addressed the vulnerability in version 3.1.8 by adding nonce validation to the affected AJAX handler. Review the patched code at line 337 and line 789. Site owners should install the update through the WordPress plugin manager and verify the version reported under Plugins > Installed Plugins.

Workarounds

Disable the Wishlist for WooCommerce plugin until patching is complete
Restrict administrator browser sessions to trusted contexts and avoid clicking unsolicited links while authenticated
Deploy a Web Application Firewall (WAF) rule that blocks admin-ajax.php requests with action=save_to_multiple_wishlist when the request lacks a valid same-origin Referer

bash

# Example WAF rule concept (ModSecurity syntax)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1013774,msg:'Block CVE-2024-13774 CSRF attempts'"
SecRule ARGS:action "@streq save_to_multiple_wishlist" "chain"
SecRule &REQUEST_HEADERS:Referer "@eq 0"