CVE-2024-1489: WooCommerce SMS Alert CSRF Vulnerability

CVE-2024-1489 Overview

The SMS Alert Order Notifications WooCommerce plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 3.6.9. The flaw stems from missing or incorrect nonce validation on the processBulkAction function. Unauthenticated attackers can delete pages and posts through forged requests when a site administrator is tricked into clicking a malicious link. The vulnerability is classified under CWE-352 and requires user interaction to exploit. The plugin is developed by Cozyvision and integrates with WooCommerce to deliver SMS notifications for order events.

Critical Impact
Successful exploitation allows unauthenticated attackers to delete WordPress pages and posts through forged administrator requests, resulting in content loss and potential site disruption.

Affected Products

Cozyvision SMS Alert Order Notifications WooCommerce plugin versions up to and including 3.6.9
WordPress installations running the affected plugin
WooCommerce sites using SMS Alert Order Notifications for order management

Discovery Timeline

2024-03-13 - CVE-2024-1489 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1489

Vulnerability Analysis

The vulnerability resides in the processBulkAction function within the SMS Alert Order Notifications plugin. WordPress plugins are expected to validate a security token, called a nonce, before performing state-changing operations. This function either omits the nonce check entirely or implements it incorrectly. As a result, the plugin cannot verify that requests originate from a legitimate authenticated session.

An attacker crafts a malicious webpage or email link that triggers the vulnerable action. When an authenticated administrator visits the attacker-controlled resource, the browser sends the request with the administrator's session cookies. The plugin processes the request as legitimate and executes the bulk action, deleting the targeted pages or posts.

Root Cause

The root cause is missing or improper CSRF token validation in the processBulkAction handler. WordPress provides the wp_verify_nonce() and check_admin_referer() functions to protect against forged requests. The affected plugin does not correctly apply these controls before executing bulk deletion operations, allowing forged requests to pass authorization checks based solely on the victim's active session.

Attack Vector

Exploitation requires an authenticated WordPress administrator to interact with attacker-supplied content. The attacker hosts a page containing a hidden form or image tag that issues the vulnerable request to the target WordPress site. Once the administrator visits the page, the browser automatically attaches session cookies and the deletion action executes without any additional prompt. No direct authentication to the target site is required from the attacker.

Refer to the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2024-1489

Indicators of Compromise

Unexpected deletion of WordPress pages or posts without corresponding administrator action in audit logs
HTTP POST requests to the plugin's bulk action endpoints originating from external referrers
Administrator sessions showing navigation to unknown external URLs immediately before content deletion events
Absence of a valid _wpnonce parameter on requests targeting the processBulkAction handler

Detection Strategies

Review web server access logs for requests to plugin admin endpoints with suspicious Referer headers pointing to untrusted domains
Monitor WordPress database changes with plugins that track content modifications and correlate deletions with authenticated session activity
Inspect requests to wp-admin endpoints for missing or malformed nonce tokens on state-changing operations

Monitoring Recommendations

Enable WordPress audit logging to capture all page and post deletion events with user, timestamp, and source IP
Alert on bulk deletion actions performed within short timeframes following administrator login
Track installed plugin versions across WordPress deployments and flag instances running SMS Alert Order Notifications version 3.6.9 or earlier

How to Mitigate CVE-2024-1489

Immediate Actions Required

Update the SMS Alert Order Notifications WooCommerce plugin to a version later than 3.6.9 immediately
Audit WordPress content for missing pages or posts and restore from backups if unauthorized deletions are found
Instruct administrators to log out of WordPress sessions when not actively managing the site

Patch Information

The vendor addressed the vulnerability in a version subsequent to 3.6.9. The fix adds proper nonce validation to the processBulkAction function. Review the WordPress Plugin Changeset for the exact code changes applied to the plugin trunk.

Workarounds

Deactivate the SMS Alert Order Notifications plugin until the patched version can be installed
Restrict administrator access to trusted networks using IP allowlists at the web server or firewall layer
Deploy a web application firewall rule to block requests to the plugin's bulk action endpoint that lack a valid _wpnonce parameter
Train administrators to avoid clicking untrusted links while logged into WordPress with elevated privileges

bash

# Example: disable the vulnerable plugin via WP-CLI until patched
wp plugin deactivate sms-alert