CVE-2024-24702: Sivel Pagerestrict CSRF Vulnerability

CVE-2024-24702 Overview

CVE-2024-24702 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Page Restrict WordPress plugin by Matt Martz and Andy Stratton. The flaw exists in all versions up to and including 2.5.5. The vulnerability is classified under CWE-352 and stems from missing or improperly validated anti-CSRF tokens in privileged plugin actions.

An attacker who tricks an authenticated administrator into visiting a crafted page can force the browser to issue state-changing requests to the WordPress site. The result is unauthorized modification of plugin configuration and access control settings governing restricted pages.

Critical Impact
Successful exploitation allows attackers to alter Page Restrict settings on a vulnerable WordPress site by abusing an authenticated administrator's session, undermining content access controls and site integrity.

Affected Products

Page Restrict WordPress plugin versions up to and including 2.5.5
WordPress sites using sivel:pagerestrict for page-level access control
Any deployment exposing the plugin's privileged endpoints to authenticated administrators

Discovery Timeline

2024-02-28 - CVE-2024-24702 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24702

Vulnerability Analysis

The Page Restrict plugin handles requests that modify access control settings without sufficient verification of request origin. The plugin fails to validate a WordPress nonce (wp_nonce) or equivalent anti-CSRF token on privileged actions, allowing forged requests to be processed as legitimate.

Exploitation requires user interaction. An authenticated administrator must visit an attacker-controlled page or click a crafted link while logged into the target WordPress instance. The attack vector is network-based and exploitable over standard HTTP/HTTPS without authentication on the attacker side. Because the request is issued from the victim's authenticated browser, the server applies the administrator's privileges to the forged action.

Root Cause

The root cause is missing CSRF protection on state-changing endpoints within the plugin. WordPress provides built-in nonce primitives such as wp_create_nonce(), check_admin_referer(), and wp_verify_nonce() that bind requests to user sessions. The vulnerable code paths in versions through 2.5.5 do not invoke these checks, so any same-origin or cross-origin request bearing valid session cookies is accepted.

Attack Vector

An attacker hosts an HTML page containing an auto-submitting form or image tag targeting the vulnerable endpoint on the WordPress site. When an administrator visits the page, the browser includes the active WordPress session cookies. The server processes the request and applies the attacker-controlled parameters to the plugin configuration. The result is unauthorized modification of restricted page settings, with confidentiality, integrity, and availability impact tied to the administrator role.

No proof-of-concept code has been published in connection with this advisory. Refer to the Patchstack Vulnerability Advisory for vendor-confirmed technical detail.

Detection Methods for CVE-2024-24702

Indicators of Compromise

Unexpected changes to Page Restrict plugin configuration or restricted-page lists in wp_options
WordPress access logs showing administrator POST requests to plugin endpoints with Referer headers pointing to external domains
Administrator session activity originating from pages outside the /wp-admin/ path immediately preceding configuration changes

Detection Strategies

Inspect WordPress audit logs for plugin setting changes that lack a corresponding administrator-initiated session in /wp-admin/
Correlate browser referer headers with administrator state-changing requests to identify off-origin triggers
Monitor file integrity on plugin-managed options and database rows tied to pagerestrict

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture user, IP, referer, and changed values for every administrative action
Forward web server access logs to a centralized log platform and alert on POST requests to plugin endpoints carrying external referers
Track administrator account behavior for configuration changes occurring outside of normal maintenance windows

How to Mitigate CVE-2024-24702

Immediate Actions Required

Update the Page Restrict plugin to a version later than 2.5.5 as soon as the vendor releases a fixed build
Audit current Page Restrict configuration and restricted-page assignments for unauthorized modifications
Require administrators to log out of WordPress sessions before browsing untrusted sites until patching is complete

Patch Information

The vulnerability affects Page Restrict versions through 2.5.5. Consult the Patchstack Vulnerability Advisory for current fixed-version guidance and apply the latest available release from the WordPress plugin repository.

Workarounds

Deactivate the Page Restrict plugin until a patched version is installed if restricted-page functionality is non-essential
Deploy a Web Application Firewall (WAF) rule that blocks state-changing requests to plugin endpoints when the Referer or Origin header is absent or external
Restrict access to /wp-admin/ by source IP using web server or firewall controls to reduce the attack surface for administrator sessions
Enforce short administrator session lifetimes and require re-authentication for sensitive plugin configuration changes

bash

# Example Apache configuration to require same-origin Referer on plugin admin POSTs
<LocationMatch "^/wp-admin/admin\.php">
    <RequireAll>
        Require all granted
        <If "%{REQUEST_METHOD} == 'POST' && %{HTTP_REFERER} !~ m#^https://your-site\.example/#">
            Require all denied
        </If>
    </RequireAll>
</LocationMatch>