CVE-2024-13883: WPUpper Share Buttons CSRF Vulnerability

CVE-2024-13883 Overview

CVE-2024-13883 is a Cross-Site Request Forgery (CSRF) vulnerability in the WPUpper Share Buttons plugin for WordPress. The flaw affects all plugin versions up to and including 3.51. It stems from missing or incorrect nonce validation in the save_custom_css_request function within the AJAX controller.

Unauthenticated attackers can inject arbitrary custom CSS into a target WordPress site by tricking an administrator into clicking a crafted link. The injected CSS modifies the visual presentation of the affected site. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows unauthenticated attackers to modify site appearance through injected CSS by leveraging an authenticated administrator's session.

Affected Products

WPUpper Share Buttons plugin for WordPress, all versions through 3.51
WordPress sites running the vulnerable victorfreitas/wpupper_share_buttons component
Any WordPress installation where administrators can be targeted via phishing

Discovery Timeline

2025-02-21 - CVE-2024-13883 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13883

Vulnerability Analysis

The vulnerability exists in the plugin's AJAX controller at Controller/ajax.controller.php. The save_custom_css_request handler processes requests to save custom CSS but lacks a valid nonce verification check. WordPress relies on nonces to bind state-changing requests to an authenticated user session.

Without nonce validation, the endpoint accepts any request that carries the administrator's authentication cookies. An attacker hosts a page containing a hidden form or automatically submitted request targeting the vulnerable endpoint. When an authenticated administrator visits the attacker-controlled page, the browser submits the request with valid session credentials.

The CSS payload is stored and applied site-wide, enabling defacement or UI redressing attacks. While the immediate impact is limited to CSS content, attackers can leverage CSS to hide legitimate elements, overlay fake login prompts, or exfiltrate limited data through attribute selectors.

Root Cause

The root cause is the absence of a check_ajax_referer() or wp_verify_nonce() call in the save_custom_css_request function before persisting user-supplied CSS. WordPress documentation explicitly requires nonce validation on privileged AJAX actions to prevent CSRF.

Attack Vector

The attack requires network access to reach the WordPress site and user interaction from an authenticated administrator. The attacker crafts a malicious HTML page or link that triggers a POST request to the vulnerable AJAX endpoint. Delivery typically occurs through phishing emails, forum posts, or compromised third-party sites.

The vulnerability manifests in the AJAX handler responsible for processing custom CSS submissions. Because no cryptographic token binds the request to an administrator session, the browser's automatic cookie inclusion is sufficient to execute the state change. See the WordPress plugin source code and the Wordfence vulnerability analysis for technical details.

Detection Methods for CVE-2024-13883

Indicators of Compromise

Unexpected modifications to the plugin's stored custom CSS values in the WordPress options table
Web server access logs showing POST requests to admin-ajax.php with the save_custom_css_request action originating from external referrers
Administrator sessions loading external pages immediately before CSS changes appear on the site

Detection Strategies

Monitor WordPress audit logs for changes to plugin settings, particularly custom CSS fields, and correlate with administrator activity
Inspect HTTP request referrer headers on AJAX calls to the affected endpoint to detect cross-origin submissions
Deploy a Web Application Firewall (WAF) rule that flags requests to save_custom_css_request lacking a valid same-origin referrer

Monitoring Recommendations

Enable file integrity monitoring on WordPress plugin directories and the wp_options table entries used by WPUpper Share Buttons
Alert on administrator account activity that immediately follows external link clicks or webmail sessions
Review outbound requests initiated by administrator browsers for connections to newly registered or suspicious domains

How to Mitigate CVE-2024-13883

Immediate Actions Required

Update the WPUpper Share Buttons plugin to a version beyond 3.51 that includes the fix from WordPress changeset #3262537
Deactivate and remove the plugin if a patched version is unavailable or the plugin is no longer required
Audit stored custom CSS values and revert any unauthorized modifications

Patch Information

The vendor addressed the vulnerability in WordPress changeset #3262537 by adding proper nonce verification to the save_custom_css_request function. WordPress site administrators should apply the update through the plugin management interface or via WP-CLI.

Workarounds

Restrict administrative access to trusted networks using IP allowlisting at the web server or WAF layer
Require administrators to use a dedicated browser profile for WordPress administration to reduce cross-site request exposure
Implement a Content Security Policy that limits which origins can submit forms targeting the WordPress admin interface
Train administrators to avoid clicking unsolicited links while authenticated to the WordPress dashboard

bash

# Update WPUpper Share Buttons plugin using WP-CLI
wp plugin update wpupper-share-buttons

# Verify installed version is patched
wp plugin get wpupper-share-buttons --field=version

# If the plugin is not required, deactivate and remove it
wp plugin deactivate wpupper-share-buttons
wp plugin delete wpupper-share-buttons