CVE-2024-13795 Overview
CVE-2024-13795 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress. The flaw exists in all versions up to and including 6.12.27. The vulnerability stems from missing or incorrect nonce validation on the ecwid_deactivate_feedback() function. Unauthenticated attackers can send deactivation feedback messages on behalf of a site owner by tricking an administrator into clicking a crafted link.
Critical Impact
Attackers can forge deactivation feedback submissions attributed to an authenticated WordPress administrator, resulting in limited integrity impact against affected sites.
Affected Products
- Lightspeed Ecwid Ecommerce Shopping Cart plugin for WordPress
- All versions up to and including 6.12.27
- WordPress sites with the affected plugin installed and activated
Discovery Timeline
- 2025-02-18 - CVE-2024-13795 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13795
Vulnerability Analysis
The Ecwid by Lightspeed plugin exposes the ecwid_deactivate_feedback() function without proper request origin validation. WordPress plugins normally protect state-changing actions with nonces, which are per-user tokens that verify a request originated from a legitimate session. In this case, the nonce check is either missing or incorrectly implemented, allowing an off-site page to trigger the action if an administrator visits it.
A successful attack requires the administrator to be authenticated and to interact with an attacker-controlled resource such as a malicious link or embedded page. Because the impacted function only handles deactivation feedback submissions, the exploitation impact is limited to integrity of that specific workflow. Confidentiality and availability are not directly affected.
Root Cause
The root cause is inadequate CSRF protection on the ecwid_deactivate_feedback() endpoint. WordPress provides wp_verify_nonce() and check_admin_referer() primitives for this purpose. The vulnerable handler does not enforce these checks correctly, so requests carrying the administrator's session cookie are accepted regardless of origin.
Attack Vector
Exploitation follows the standard CSRF pattern for WordPress administrative actions. An attacker crafts a page or link that issues a request to the vulnerable plugin endpoint. When an authenticated administrator visits the attacker-controlled resource, the browser attaches the session cookie and the plugin processes the forged deactivation feedback as legitimate. No credentials or elevated privileges are required from the attacker. See the Wordfence Vulnerability Report for additional technical context.
No verified public proof-of-concept code has been published for this issue. Refer to the WordPress Plugin Changeset for the corresponding source code fix.
Detection Methods for CVE-2024-13795
Indicators of Compromise
- Unexpected deactivation feedback events originating from the Ecwid plugin in WordPress logs
- HTTP POST requests to the plugin's admin-ajax or admin-post endpoints that invoke ecwid_deactivate_feedback with external Referer headers
- Administrator sessions submitting plugin actions immediately after clicking external links or opening untrusted email content
Detection Strategies
- Inspect web server access logs for POST requests to wp-admin/admin-ajax.php or admin-post.php containing the ecwid_deactivate_feedback action parameter and a Referer outside the WordPress host
- Enable and review WordPress audit logging for plugin state changes and feedback submissions performed by administrators
- Correlate authentication events, browser activity, and outbound HTTP traffic to detect CSRF chains that end with plugin administrative actions
Monitoring Recommendations
- Deploy a Web Application Firewall (WAF) with rules that verify the presence and validity of WordPress nonces on plugin admin endpoints
- Alert on administrator accounts triggering plugin admin actions from sessions with anomalous Referer or Origin headers
- Track plugin version inventory across WordPress deployments to identify hosts still running Ecwid 6.12.27 or earlier
How to Mitigate CVE-2024-13795
Immediate Actions Required
- Update the Ecwid by Lightspeed Ecommerce Shopping Cart plugin to a version later than 6.12.27 on every affected WordPress site
- Audit administrator accounts and reduce the number of users holding the administrator role to the minimum required
- Instruct administrators to log out of WordPress before browsing untrusted sites or clicking links from unknown senders
Patch Information
Lightspeed addressed the missing nonce validation in the Ecwid plugin source tree. The corrective change is available in the WordPress Plugin Changeset. Site owners should apply the plugin update through the WordPress admin dashboard or by deploying the fixed release from the plugin repository.
Workarounds
- Temporarily deactivate the Ecwid plugin on sites that cannot be updated immediately
- Restrict access to wp-admin by IP allow-list at the web server or WAF to reduce CSRF exposure
- Enforce administrator session hardening such as short cookie lifetimes and SameSite=Lax or SameSite=Strict on WordPress authentication cookies
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
