CVE-2024-30456 Overview
CVE-2024-30456 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the realmag777 WPCS (WordPress Currency Switcher Professional) plugin. The flaw impacts all versions up to and including 1.2.0.1. An attacker can trick an authenticated WordPress user into submitting a forged request that performs privileged actions within the plugin. Successful exploitation requires user interaction, but the network attack vector and lack of required privileges make phishing-based delivery practical. The weakness is categorized under CWE-352.
Critical Impact
Successful exploitation can result in high impact to confidentiality, integrity, and availability of the affected WordPress site through unauthorized actions performed in the context of a victim's session.
Affected Products
- Pluginus WordPress Currency Switcher (WPCS) Professional plugin
- All versions from n/a through 1.2.0.1
- WordPress sites running the affected plugin with authenticated users
Discovery Timeline
- 2024-03-29 - CVE-2024-30456 published to NVD
- 2026-04-28 - Last updated in NVD database
Technical Details for CVE-2024-30456
Vulnerability Analysis
The vulnerability stems from missing or insufficient anti-CSRF protections within the WPCS plugin's request handlers. State-changing endpoints accept requests without validating a unique, unpredictable token tied to the user's session. An attacker hosts or injects a crafted page that issues a request to a vulnerable plugin endpoint. When a logged-in WordPress administrator visits that page, the browser automatically attaches authentication cookies, and the request executes with the administrator's privileges.
The attack vector is network-based and requires user interaction such as clicking a link or visiting a malicious page. No authentication is required from the attacker, since the victim's browser supplies valid session credentials. The EPSS score is 0.241%, reflecting the requirement for victim interaction.
Root Cause
The plugin's administrative request handlers do not verify a WordPress nonce or equivalent anti-CSRF token before processing state-changing operations. Standard WordPress practice requires calling wp_verify_nonce() or check_admin_referer() on every privileged action. The absence of these checks allows cross-origin requests to alter plugin configuration or trigger functionality intended for administrators only.
Attack Vector
Exploitation typically proceeds as follows. An attacker crafts an HTML page containing a hidden form or image tag that targets a vulnerable WPCS endpoint. The attacker delivers the link through phishing, a comment, or a compromised site. When an authenticated WordPress administrator loads the page, the browser issues the forged request with session cookies attached, and the plugin processes the action without further validation.
No verified public proof-of-concept code is available. See the Patchstack CSRF Vulnerability Advisory for additional technical context.
Detection Methods for CVE-2024-30456
Indicators of Compromise
- Unexpected modifications to WPCS plugin settings, currency configurations, or exchange rate sources without corresponding administrator activity logs.
- HTTP requests to WPCS admin endpoints with Referer headers pointing to external or untrusted domains.
- POST requests to plugin handlers that lack a valid WordPress nonce parameter (_wpnonce).
- Administrator account activity originating from unusual user-agent strings or off-hours sessions.
Detection Strategies
- Inspect web server access logs for requests to WPCS plugin endpoints with cross-origin Referer or Origin headers.
- Enable WordPress audit logging to capture plugin configuration changes and correlate them with authenticated sessions.
- Deploy a Web Application Firewall (WAF) rule that flags POST requests to plugin admin handlers missing the _wpnonce parameter.
Monitoring Recommendations
- Monitor for outbound browser requests from administrator workstations that immediately trigger inbound POST requests to the WordPress site.
- Track changes to plugin database options (wp_options entries owned by WPCS) and alert on unscheduled modifications.
- Centralize WordPress and reverse proxy logs in a SIEM and build correlation rules around administrator session activity.
How to Mitigate CVE-2024-30456
Immediate Actions Required
- Update the WPCS WordPress Currency Switcher Professional plugin to a version later than 1.2.0.1 as soon as the vendor publishes a fix.
- If no patched version is available, deactivate and remove the plugin from production WordPress installations.
- Force administrator session re-authentication and rotate any API keys used by the plugin.
Patch Information
The vendor advisory tracked through Patchstack identifies versions through 1.2.0.1 as vulnerable. Administrators should consult the Patchstack CSRF Vulnerability Advisory for the latest fixed-version information and apply the upgrade through the WordPress admin console once available.
Workarounds
- Restrict access to /wp-admin/ by IP allowlist at the reverse proxy or WAF layer to limit who can trigger plugin endpoints.
- Require administrators to use a separate browser profile or session for WordPress administration to reduce exposure to forged requests.
- Configure the WordPress site to enforce SameSite=Strict or SameSite=Lax on authentication cookies where supported.
- Deploy WAF rules that reject state-changing requests to plugin endpoints lacking a valid _wpnonce parameter.
# Example WAF rule (ModSecurity) blocking WPCS admin POSTs without a nonce
SecRule REQUEST_METHOD "@streq POST" \
"chain,phase:2,deny,status:403,id:1003001,\
msg:'Possible CSRF against WPCS plugin'"
SecRule REQUEST_URI "@contains /wp-admin/admin.php" "chain"
SecRule ARGS:page "@rx ^wpcs" "chain"
SecRule &ARGS:_wpnonce "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
