CVE-2024-24887: Contest Gallery WordPress CSRF Vulnerability

CVE-2024-24887 Overview

CVE-2024-24887 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Photos and Files Contest Gallery WordPress plugin by Contest Gallery. The flaw exists in all versions up to and including 21.2.8.4. An attacker can craft a malicious request that, when triggered by an authenticated administrator, causes the WordPress site to create a gallery without the administrator's consent. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery and requires user interaction to succeed. Because it abuses the trust the application places in the victim's authenticated session, exploitation does not require valid attacker credentials.

Critical Impact
A successful CSRF attack against an authenticated administrator can result in unauthorized gallery creation, leading to compromise of site integrity, confidentiality, and availability.

Affected Products

Contest Gallery – Photos and Files Contest Gallery Plugin for WordPress, versions up to and including 21.2.8.4
Plugin features impacted: Contact Form, Upload Form, Social Share, and Voting components
WordPress sites running the vulnerable plugin with administrator sessions exposed to untrusted browsing

Discovery Timeline

2024-02-12 - CVE-2024-24887 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24887

Vulnerability Analysis

The Contest Gallery plugin exposes administrative actions that create new galleries without verifying a valid anti-CSRF token. WordPress provides the wp_nonce_field() and check_admin_referer() primitives for exactly this purpose, but the affected handler does not enforce nonce validation. As a result, the plugin accepts state-changing requests purely on the basis of an authenticated session cookie. An attacker exploits this by tricking an authenticated administrator into loading an attacker-controlled page or clicking a crafted link. The browser automatically attaches the administrator's session cookies to the forged request, and the plugin processes it as legitimate. The attack vector is network-based and requires user interaction, consistent with classic CSRF behavior.

Root Cause

The root cause is missing or improper request origin validation in the plugin's gallery creation endpoint. The handler does not verify a unique per-session nonce, nor does it validate the Referer or Origin headers. This violates the secure coding requirement described in CWE-352.

Attack Vector

Exploitation requires an attacker to host a malicious page containing an auto-submitting HTML form or hidden image tag pointing at the vulnerable plugin endpoint. The attacker then lures an authenticated WordPress administrator to visit the page. Because the browser sends valid session cookies with the cross-site request, the plugin executes the gallery creation action under the administrator's identity. See the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-24887

Indicators of Compromise

Unexpected new gallery entries created in the WordPress database table associated with the Contest Gallery plugin
Administrator activity in access logs originating from Referer headers pointing to external, untrusted domains
POST requests to Contest Gallery admin endpoints without an accompanying _wpnonce parameter
Unusual gallery creation events occurring outside normal administrative working hours

Detection Strategies

Review WordPress audit logs for gallery creation events and correlate them with administrator browsing activity
Inspect HTTP request logs at the web server or WAF layer for cross-origin POST requests targeting Contest Gallery endpoints
Alert on requests to plugin administrative actions that lack expected nonce parameters
Monitor for clusters of administrator session activity immediately following navigation to external URLs

Monitoring Recommendations

Enable verbose access logging on /wp-admin/ for the duration of investigation and patching
Deploy WordPress security plugins that log all administrative state changes with originating IP and Referer
Forward web server logs to a centralized log analytics platform for retention and correlation
Configure alerting on creation of new galleries when no corresponding administrator console session exists

How to Mitigate CVE-2024-24887

Immediate Actions Required

Upgrade the Contest Gallery plugin to a version higher than 21.2.8.4 as soon as the vendor publishes a fixed release
Audit existing galleries for unauthorized entries and remove any that cannot be attributed to legitimate administrator activity
Force a password reset and session invalidation for all WordPress administrator accounts
Restrict /wp-admin/ access by IP allowlist where feasible

Patch Information

Refer to the Patchstack Vulnerability Report for the latest patch availability. Administrators should update through the WordPress plugin manager once a fixed version is released and verify the installed version is greater than 21.2.8.4.

Workarounds

Deactivate the Contest Gallery plugin until a patched version is installed if gallery functionality is non-essential
Deploy a Web Application Firewall (WAF) rule that blocks cross-origin POST requests to Contest Gallery admin endpoints by inspecting the Origin and Referer headers
Instruct administrators to use a dedicated browser profile for WordPress administration and to log out immediately after use
Enable SameSite cookie attributes at the WordPress level to reduce cross-site cookie attachment

bash

# Example Apache WAF rule to block cross-origin POSTs to Contest Gallery endpoints
<LocationMatch "/wp-admin/admin\.php">
    SetEnvIfNoCase Referer "^https?://(www\.)?yourdomain\.com" trusted_referer
    <RequireAll>
        Require all granted
        Require env trusted_referer
    </RequireAll>
</LocationMatch>