CVE-2024-24875: Link Library CSRF Vulnerability

CVE-2024-24875 Overview

CVE-2024-24875 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Yannick Lefebvre Link Library plugin for WordPress. The flaw impacts all plugin versions up to and including 7.5.13. An attacker can craft a malicious web page that triggers unauthorized state-changing actions in the plugin when an authenticated administrator visits it. Successful exploitation requires user interaction but no prior authentication on the attacker side, and can lead to compromise of confidentiality, integrity, and availability of the WordPress site. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker who lures an authenticated WordPress administrator to a malicious page can perform unauthorized plugin actions, potentially leading to full site compromise.

Affected Products

Yannick Lefebvre Link Library plugin for WordPress
All versions from n/a through 7.5.13
WordPress installations with Link Library plugin enabled

Discovery Timeline

2024-02-12 - CVE-2024-24875 published to the National Vulnerability Database (NVD)
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-24875

Vulnerability Analysis

The Link Library plugin fails to validate the origin of state-changing HTTP requests sent to its administrative endpoints. WordPress provides a nonce mechanism (wp_nonce_field and check_admin_referer) for protecting against CSRF, but the affected handlers do not enforce this validation. As a result, an authenticated administrator browsing an attacker-controlled page can be coerced into submitting requests that modify plugin data or configuration. The attack is network-based, requires user interaction, and does not require attacker credentials.

Root Cause

The root cause is missing or improperly implemented anti-CSRF token verification in one or more request handlers exposed by the plugin. Without nonce validation, the plugin cannot distinguish between a legitimate request initiated from the WordPress admin UI and a forged request crafted by an attacker. This is a classic [CWE-352] defect in WordPress plugin development.

Attack Vector

Exploitation typically follows this pattern: an attacker hosts a malicious page containing an auto-submitting HTML form or JavaScript-driven fetch request targeting a vulnerable Link Library endpoint. The attacker then lures a logged-in WordPress administrator to visit the page through phishing or a malicious link. The victim's browser automatically attaches their authenticated session cookies, and the request is processed by the plugin as if it were legitimate. Depending on the targeted endpoint, the attacker may add, modify, or delete links and library settings, with downstream impact on site content and integrity. Full technical details are documented in the Patchstack Vulnerability Database Entry.

Detection Methods for CVE-2024-24875

Indicators of Compromise

Unexpected modifications, additions, or deletions of link entries in the Link Library plugin database tables.
WordPress access logs showing POST requests to Link Library admin endpoints with Referer headers pointing to external or untrusted domains.
Administrator account activity correlated with visits to unknown external URLs immediately preceding configuration changes.

Detection Strategies

Audit HTTP request logs for requests to wp-admin/admin.php?page=link-library* lacking valid WordPress nonce parameters.
Correlate browser history or proxy logs of administrator workstations with timestamps of plugin configuration changes.
Use WordPress security plugins or file integrity monitoring to detect unauthorized changes to plugin settings and database content.

Monitoring Recommendations

Enable WordPress audit logging to record all administrative actions performed by privileged users.
Monitor outbound web traffic from administrator endpoints for connections to suspicious or newly registered domains.
Forward web server access logs to a centralized SIEM and alert on anomalous Referer headers targeting plugin admin pages.

How to Mitigate CVE-2024-24875

Immediate Actions Required

Update the Yannick Lefebvre Link Library plugin to a version later than 7.5.13 as soon as a fixed release is available.
If a patched version is not yet available, disable or uninstall the Link Library plugin until a fix is published.
Require WordPress administrators to log out of admin sessions when not actively managing the site.

Patch Information

At the time of publication, the vulnerability affects Link Library through version 7.5.13. Site operators should consult the Patchstack advisory for the latest fixed version and apply updates through the WordPress plugin manager.

Workarounds

Deploy a Web Application Firewall (WAF) rule to block requests to Link Library admin endpoints that lack a valid _wpnonce parameter or have suspicious Referer headers.
Restrict access to /wp-admin/ to known administrator IP addresses using web server or firewall rules.
Enforce browser session isolation for administrator accounts by using a dedicated browser profile only for WordPress administration.

bash

# Example nginx rule to block requests to Link Library admin pages without a valid Referer
location ~* /wp-admin/admin\.php {
    if ($arg_page ~* "link-library") {
        if ($http_referer !~* "^https://your-wordpress-site\.example/") {
            return 403;
        }
    }
}