CVE-2024-24929 Overview
CVE-2024-24929 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the WP Contact Form plugin for WordPress, originally authored by Ryan Duff and Peter Westwood. The flaw impacts all plugin versions up to and including 1.6. An attacker can craft a malicious web page that, when visited by an authenticated administrator, forces the browser to submit unauthorized requests to the vulnerable plugin endpoints.
Critical Impact
Successful exploitation allows attackers to perform privileged actions on a WordPress site by tricking an authenticated user into clicking a crafted link, potentially leading to full site compromise.
Affected Products
- WP Contact Form plugin for WordPress versions up to and including 1.6
- WordPress installations using the ftwr:wp_contact_form component
- Sites with administrators who interact with attacker-controlled content while logged in
Discovery Timeline
- 2024-02-12 - CVE-2024-24929 published to NVD
- 2026-04-28 - Last updated in NVD database
Technical Details for CVE-2024-24929
Vulnerability Analysis
The WP Contact Form plugin fails to validate the origin and intent of state-changing HTTP requests. WordPress provides nonce tokens (wp_nonce_field() and check_admin_referer()) to defend against CSRF, but the affected plugin versions do not enforce these checks on sensitive actions. An attacker who knows the endpoint structure can build an HTML form or image tag that triggers a request when an authenticated administrator loads it.
Because the browser automatically includes the administrator's WordPress session cookies, the request is processed with full privileges. The vulnerability requires user interaction, meaning the victim must visit an attacker-controlled page or click a crafted link while authenticated to the target site.
Root Cause
The root cause is missing CSRF protection on plugin endpoints that modify state. The plugin does not verify a nonce, check the HTTP Referer header, or require a re-authentication step before processing sensitive operations. This omission maps directly to [CWE-352]: Cross-Site Request Forgery.
Attack Vector
The attack is delivered over the network and requires user interaction. An attacker hosts a malicious page containing an auto-submitting form or hidden request targeting the vulnerable WP Contact Form endpoint. When an authenticated WordPress administrator visits that page, their browser issues the request with valid session cookies. The plugin processes the forged request as if it originated from the administrator.
No proof-of-concept code is publicly available for this vulnerability. See the Patchstack Vulnerability Analysis for additional technical details.
Detection Methods for CVE-2024-24929
Indicators of Compromise
- Unexpected configuration changes to the WP Contact Form plugin settings without corresponding administrator activity in audit logs
- POST requests to plugin endpoints with Referer headers pointing to external or unrelated domains
- Administrator session activity originating from page loads on third-party sites
Detection Strategies
- Inspect web server access logs for state-changing requests to WP Contact Form URLs that lack a valid same-origin Referer or Origin header
- Correlate WordPress admin actions with browser navigation history to identify requests not initiated from the admin dashboard
- Deploy a Web Application Firewall (WAF) rule that blocks POST requests to plugin endpoints missing a valid WordPress nonce parameter
Monitoring Recommendations
- Enable WordPress audit logging plugins to record all administrative actions and configuration changes
- Monitor outbound requests from administrator workstations to flag suspicious cross-origin form submissions
- Alert on changes to plugin configuration files and database options associated with WP Contact Form
How to Mitigate CVE-2024-24929
Immediate Actions Required
- Disable or remove the WP Contact Form plugin until a patched version is verified
- Require administrators to log out of WordPress sessions when browsing untrusted sites
- Apply a WAF rule that enforces nonce validation on requests to the plugin endpoints
Patch Information
No fixed version is identified in the available CVE data. Refer to the Patchstack Vulnerability Analysis for the latest remediation guidance and replace the plugin with a maintained alternative if no update is published.
Workarounds
- Replace WP Contact Form with an actively maintained contact form plugin that implements proper nonce verification
- Restrict WordPress administrator accounts to dedicated browsers or browser profiles used only for site management
- Enforce SameSite=Lax or SameSite=Strict cookie attributes on WordPress session cookies to limit cross-site request inclusion
- Implement multi-factor authentication and least-privilege role assignments to reduce the impact of forged requests
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
