CVE-2024-27968: Optimole Super Page Cache CSRF Vulnerability

CVE-2024-27968 Overview

CVE-2024-27968 is a Cross-Site Request Forgery (CSRF) vulnerability in the Optimole Super Page Cache for Cloudflare WordPress plugin. The flaw affects all versions up to and including 4.7.5. Successful exploitation chains CSRF with Stored Cross-Site Scripting (XSS), allowing attackers to inject persistent JavaScript into administrative interfaces. Exploitation requires a logged-in administrator to visit an attacker-controlled page. The vulnerability is tracked under CWE-352 and documented in the Patchstack advisory.

Critical Impact
Attackers can persist malicious JavaScript into WordPress admin pages by tricking authenticated administrators into visiting a crafted URL, leading to session hijacking or backend compromise.

Affected Products

Optimole Super Page Cache for Cloudflare (WordPress plugin)
All versions from initial release through 4.7.5
WordPress installations using this caching plugin with Cloudflare integration

Discovery Timeline

2024-03-21 - CVE-2024-27968 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27968

Vulnerability Analysis

The vulnerability arises from missing or improperly validated anti-CSRF tokens on state-changing endpoints exposed by the Super Page Cache for Cloudflare plugin. An attacker crafts a malicious HTML page containing a forged request targeting the plugin's administrative actions. When an authenticated WordPress administrator visits the attacker's page, the browser submits the forged request using the administrator's active session cookies.

Because the request is trusted, the plugin processes attacker-supplied input and stores it without adequate sanitization. This stored payload then renders inside the WordPress admin interface, executing JavaScript in the context of any administrator viewing the affected page. The chained impact expands beyond a single victim, persisting across sessions until manually removed.

Root Cause

The root cause is the absence of proper CSRF nonce verification on plugin endpoints that accept and store administrator-facing content. WordPress provides the wp_verify_nonce() and check_admin_referer() primitives specifically to prevent this class of attack. The plugin also fails to sanitize or escape the stored data prior to output, enabling the secondary stored XSS payload.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts a webpage containing an auto-submitting form or JavaScript payload targeting the vulnerable plugin endpoint. Social engineering, such as a phishing email sent to a WordPress administrator, delivers the malicious link. Once the administrator visits the page while logged into WordPress, the CSRF request executes and the stored XSS payload is planted.

The vulnerability manifests through missing nonce verification on privileged plugin actions. Refer to the Patchstack advisory for additional technical detail.

Detection Methods for CVE-2024-27968

Indicators of Compromise

Unexpected <script> tags or encoded JavaScript stored within Super Page Cache for Cloudflare plugin settings or option tables
WordPress POST requests to plugin admin endpoints originating from external Referer headers
New or modified administrator accounts appearing shortly after admin sessions viewed plugin pages
Outbound requests from admin browser sessions to unfamiliar domains after loading plugin configuration screens

Detection Strategies

Review the WordPress wp_options table and plugin-specific configuration entries for unexpected HTML or script content
Inspect web server access logs for POST requests to /wp-admin/admin.php or /wp-admin/admin-ajax.php with plugin-related actions and missing or invalid nonce parameters
Deploy a web application firewall rule to flag requests to plugin endpoints lacking a valid _wpnonce parameter
Correlate admin login events with subsequent configuration changes to identify anomalous modification patterns

Monitoring Recommendations

Enable WordPress audit logging to capture all plugin setting modifications and administrator actions
Monitor egress traffic from browsers used for WordPress administration for beacons to unknown domains
Alert on any modification to plugin configuration outside authorized maintenance windows
Track browser Content Security Policy (CSP) violation reports from WordPress admin origins

How to Mitigate CVE-2024-27968

Immediate Actions Required

Update Super Page Cache for Cloudflare to a version later than 4.7.5 as soon as a fixed release is available from Optimole
Force logout of all WordPress administrator sessions and rotate administrator credentials
Audit plugin configuration and stored options for injected script content and remove any unauthorized entries
Instruct administrators to avoid visiting untrusted links while authenticated to WordPress

Patch Information

The Patchstack advisory identifies all versions through 4.7.5 as vulnerable. Administrators should apply the vendor-supplied update to the next available release and validate the fix against their environment.

Workarounds

Temporarily deactivate the Super Page Cache for Cloudflare plugin until a patched version is installed
Restrict WordPress admin access by source IP using web server or reverse proxy rules
Deploy a web application firewall rule enforcing valid _wpnonce parameters on plugin admin endpoints
Implement a strict Content Security Policy on the WordPress admin origin to limit inline script execution

bash

# Example Apache configuration restricting wp-admin access to trusted IPs
<Directory "/var/www/html/wp-admin">
    Require ip 203.0.113.0/24
    Require ip 198.51.100.42
</Directory>