CVE-2024-24935 Overview
CVE-2024-24935 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WpSimpleTools Basic Log Viewer plugin for WordPress. The flaw impacts all versions up to and including 1.0.4. An attacker can trick an authenticated administrator into submitting forged requests that perform privileged actions within the plugin. Exploitation requires user interaction, typically by luring a logged-in administrator to a malicious page. The issue is tracked under CWE-352: Cross-Site Request Forgery and was disclosed via Patchstack.
Critical Impact
Successful exploitation enables attackers to perform unauthorized state-changing actions in the WordPress admin context, potentially compromising site confidentiality, integrity, and availability.
Affected Products
- WpSimpleTools Basic Log Viewer plugin for WordPress
- All versions from n/a through 1.0.4
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2024-02-12 - CVE-2024-24935 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-24935
Vulnerability Analysis
The Basic Log Viewer plugin processes administrative requests without verifying their origin. The plugin lacks proper anti-CSRF token validation on state-changing endpoints. An attacker who hosts a crafted page or injects malicious content into a site visited by an authenticated WordPress administrator can issue forged requests using the administrator's session. Because WordPress relies on session cookies for admin authentication, the forged requests execute with full administrator privileges. The vulnerability is network-exploitable and requires no authentication on the attacker side, but it does require user interaction from a privileged victim.
Root Cause
The root cause is the absence or improper implementation of WordPress nonce verification on plugin actions. WordPress provides wp_nonce_field() and check_admin_referer() primitives to protect administrative actions. The Basic Log Viewer plugin through version 1.0.4 does not consistently validate these tokens before executing privileged operations, allowing cross-origin requests to be processed as legitimate.
Attack Vector
The attack vector is network-based and requires victim interaction. An attacker crafts a malicious HTML page containing auto-submitting forms or image tags that target the vulnerable plugin endpoints on a WordPress site. When a logged-in administrator visits the page, the browser automatically attaches session cookies, and the request is processed by the plugin. Depending on the targeted endpoint, attackers can manipulate log viewer functionality, which in WordPress environments may lead to broader site compromise.
No verified public exploit code is available. Refer to the Patchstack CVE Analysis for additional technical details.
Detection Methods for CVE-2024-24935
Indicators of Compromise
- Unexpected HTTP POST requests to Basic Log Viewer admin endpoints with Referer headers pointing to external domains
- Administrative actions in plugin logs originating from sessions that did not navigate to the plugin UI
- Unusual access patterns to /wp-admin/ pages tied to the Basic Log Viewer plugin
Detection Strategies
- Inspect web server access logs for cross-origin requests to plugin endpoints lacking valid nonce parameters
- Monitor WordPress audit logs for plugin actions executed in close succession with external referrers
- Deploy a Web Application Firewall (WAF) rule to flag requests to plugin endpoints missing the expected _wpnonce parameter
Monitoring Recommendations
- Enable verbose logging for all wp-admin plugin requests and forward logs to a centralized SIEM
- Track administrator session activity for anomalies such as actions triggered immediately after visiting external URLs
- Alert on installation of the Basic Log Viewer plugin at versions 1.0.4 or earlier across managed WordPress fleets
How to Mitigate CVE-2024-24935
Immediate Actions Required
- Identify all WordPress sites running Basic Log Viewer and inventory the installed version
- Deactivate and uninstall the plugin if a patched release is not available for your environment
- Restrict administrator browsing habits and require dedicated admin browsers or sessions
Patch Information
At the time of publication, the vendor advisory indicates the issue affects versions through 1.0.4. Review the Patchstack CVE Analysis for current patch availability and update to the latest vendor-supplied version.
Workarounds
- Remove or deactivate the Basic Log Viewer plugin until a fixed release is verified
- Deploy a WAF rule that blocks requests to plugin endpoints lacking a valid _wpnonce parameter
- Enforce SameSite=Strict or Lax cookie attributes on WordPress session cookies to limit cross-site request submission
- Require administrators to log out of WordPress when browsing untrusted sites
# Example WordPress CLI command to identify vulnerable installs
wp plugin list --name=basic-log-viewer --fields=name,status,version
# Deactivate the plugin pending a patched release
wp plugin deactivate basic-log-viewer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
