CVE-2024-21749 Overview
CVE-2024-21749 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Atakan Au 1 click disable all WordPress plugin. The flaw exists in all versions from n/a through 1.0.1. An attacker can trick an authenticated administrator into executing unintended state-changing actions by loading a crafted web page or link. Successful exploitation compromises confidentiality, integrity, and availability of the affected WordPress site.
Critical Impact
Attackers can leverage administrator sessions to disable plugin functionality or alter site configuration through forged requests, requiring only that the victim visit an attacker-controlled page.
Affected Products
- Atakan Au 1 click disable all WordPress plugin
- All versions up to and including 1.0.1
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2024-02-28 - CVE-2024-21749 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-21749
Vulnerability Analysis
The 1 click disable all plugin fails to validate the origin of state-changing HTTP requests. The plugin does not implement or verify anti-CSRF tokens (WordPress nonces) on sensitive administrative actions. An attacker who convinces an authenticated administrator to visit a malicious page can trigger requests that the WordPress backend accepts as legitimate.
The attack requires user interaction, but no prior authentication or privileges from the attacker. Because WordPress administrators typically hold full site privileges, forged requests can alter plugin state, modify configuration, or disrupt site availability. The network attack vector and low complexity make exploitation attainable through common phishing or watering-hole techniques.
Root Cause
The root cause is missing CSRF protection [CWE-352] on privileged plugin endpoints. WordPress provides the wp_nonce_field() and check_admin_referer() primitives for exactly this purpose, but the affected versions of 1 click disable all do not consistently use them. Requests originating from third-party domains are accepted when accompanied by the administrator's session cookie.
Attack Vector
An attacker crafts an HTML page containing a hidden form or image tag that submits a request to the vulnerable plugin endpoint on the target site. The attacker then lures a logged-in WordPress administrator to view the page through phishing, social engineering, or a compromised third-party site. The browser attaches the administrator's session cookies, and the plugin executes the requested action. See the Patchstack Vulnerability Advisory for technical details.
Detection Methods for CVE-2024-21749
Indicators of Compromise
- Unexpected changes to plugin configuration or bulk state changes on WordPress sites running 1 click disable all version 1.0.1 or earlier
- HTTP POST or GET requests to plugin administrative endpoints containing a Referer header from an external domain
- Administrator actions logged outside normal working hours or from unusual IP addresses
- Access logs showing requests to plugin endpoints without preceding navigation from the WordPress admin dashboard
Detection Strategies
- Inspect WordPress access logs for requests to 1 click disable all handlers where the Referer header does not match the site's own domain
- Correlate administrator session cookies with unexpected POST requests to wp-admin endpoints tied to the plugin
- Deploy a Web Application Firewall (WAF) rule that blocks state-changing requests to plugin endpoints lacking valid nonce parameters
Monitoring Recommendations
- Enable WordPress audit logging to capture all administrator-initiated plugin actions and configuration changes
- Alert on outbound requests from admin browsers to unrecognized domains during active sessions
- Monitor for sudden mass changes to plugin state across sites managed by the same administrator account
How to Mitigate CVE-2024-21749
Immediate Actions Required
- Deactivate the 1 click disable all plugin on all WordPress sites until a patched version is confirmed available
- Force logout of all WordPress administrator sessions and rotate credentials for any account exposed to untrusted content
- Restrict administrator access to trusted networks and require multi-factor authentication for the wp-admin interface
- Review recent WordPress audit logs for any state changes made through the affected plugin
Patch Information
At the time of publication, the Patchstack advisory lists version 1.0.1 as the last known affected release with no fixed version identified. Administrators should monitor the vendor and Patchstack for a patched release and apply it immediately when available.
Workarounds
- Remove the 1 click disable all plugin entirely if a patched version is not available
- Deploy a WordPress security plugin or WAF that enforces CSRF token validation on plugin administrative endpoints
- Instruct administrators to use a dedicated browser profile for WordPress management and to avoid browsing untrusted sites while authenticated
# Example: Deactivate and remove the vulnerable plugin using WP-CLI
wp plugin deactivate 1-click-disable-all
wp plugin delete 1-click-disable-all
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
