CVE-2024-21752: Ajax Search Lite CSRF Vulnerability

CVE-2024-21752 Overview

CVE-2024-21752 is a Cross-Site Request Forgery (CSRF) vulnerability in the Ernest Marcinko Ajax Search Lite WordPress plugin that leads to Reflected Cross-Site Scripting (XSS). The flaw affects all versions from initial release through 4.11.4. An attacker who tricks an authenticated user into visiting a crafted page can forge a request that reflects attacker-controlled script content back to the victim's browser. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation enables script execution in the victim's browser session, potentially leading to session hijacking, credential theft, or unauthorized administrative actions within WordPress sites running the vulnerable plugin.

Affected Products

Ernest Marcinko Ajax Search Lite for WordPress
All versions up to and including 4.11.4
WordPress sites with the ajax-search-lite plugin installed and activated

Discovery Timeline

2024-02-29 - CVE-2024-21752 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21752

Vulnerability Analysis

The vulnerability chains two weaknesses: a missing CSRF protection and insufficient output sanitization that results in reflected XSS. The Ajax Search Lite plugin exposes a request handler that lacks a valid nonce or origin check. When a logged-in user visits an attacker-controlled page, the browser silently submits a forged request to the vulnerable WordPress endpoint. Because the response reflects attacker-supplied input without adequate encoding, injected JavaScript executes in the victim's browser under the site's origin. User interaction is required, which reduces the exploitation likelihood reflected in the EPSS score of 0.199%.

Root Cause

The root cause is the absence of anti-CSRF token validation on a plugin request handler combined with a reflected XSS sink in the response. WordPress provides the wp_nonce_field() and check_admin_referer() APIs specifically to defend against CSRF, and the affected plugin does not enforce these controls on the vulnerable path. Additionally, user-controlled parameters flow into the HTML response without being passed through esc_html(), esc_attr(), or an equivalent context-aware escaping function.

Attack Vector

Exploitation is network-based and requires no privileges on the target site, but it does require the victim to interact with an attacker-controlled resource such as a malicious link or embedded image. The attacker crafts a URL or HTML form that submits parameters containing a JavaScript payload to the vulnerable Ajax Search Lite endpoint. When the authenticated victim triggers the request, the response reflects the payload and executes it in the victim's browser. Because the CVSS scope is changed, the injected script can affect resources beyond the vulnerable component itself. See the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-21752

Indicators of Compromise

Web server access logs containing requests to Ajax Search Lite endpoints with URL parameters holding <script>, javascript:, onerror=, or encoded equivalents.
HTTP Referer headers pointing to external domains for state-changing plugin requests.
Unexpected outbound requests from user browsers to attacker-controlled hosts immediately after visiting a WordPress page hosting the plugin.

Detection Strategies

Inventory WordPress installations and flag any site running ajax-search-lite at version 4.11.4 or earlier.
Deploy web application firewall (WAF) rules that inspect query strings and request bodies destined for the plugin's endpoints for XSS payload patterns.
Correlate WordPress audit logs with browser telemetry to identify authenticated sessions that received reflected script content.

Monitoring Recommendations

Enable verbose HTTP logging on WordPress front-ends and centralize logs for retention and search.
Monitor for anomalous administrative actions performed shortly after authenticated users click external links, indicating potential CSRF abuse.
Track plugin version drift across managed WordPress fleets to detect installations that regress to vulnerable builds.

How to Mitigate CVE-2024-21752

Immediate Actions Required

Update the Ajax Search Lite plugin to a version later than 4.11.4 as soon as the vendor publishes a fixed release.
If a patched version is not yet available, deactivate and remove the plugin from all WordPress installations.
Invalidate active administrator sessions and rotate credentials for accounts that may have interacted with untrusted links.

Patch Information

Refer to the Patchstack Vulnerability Report for the vendor patch status and upgrade guidance. Administrators should verify the installed plugin version through the WordPress admin dashboard under Plugins and apply available updates through the standard WordPress update mechanism.

Workarounds

Restrict administrative access to WordPress dashboards using IP allowlists or VPN-only access to reduce CSRF exposure.
Deploy a Content Security Policy (CSP) that disallows inline scripts to reduce the impact of reflected XSS payloads.
Configure WAF signatures to block requests to Ajax Search Lite endpoints that contain script-like payloads or lack expected Referer and nonce values.
Train site administrators to avoid clicking untrusted links while authenticated to the WordPress admin console.

bash

# Configuration example: identify vulnerable Ajax Search Lite installations via WP-CLI
wp plugin list --name=ajax-search-lite --fields=name,status,version

# Deactivate the plugin until a patched version is installed
wp plugin deactivate ajax-search-lite