CVE-2024-30457: WordPress MDTF Plugin CSRF Vulnerability

CVE-2024-30457 Overview

CVE-2024-30457 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) plugin. The issue impacts all versions from n/a through 1.3.3.1. The flaw is categorized under [CWE-352] and stems from missing or improper anti-CSRF protections in plugin request handlers.

An attacker can craft a malicious web page that, when visited by an authenticated WordPress administrator, issues forged state-changing requests to the target site. Successful exploitation requires user interaction and can lead to unauthorized changes affecting confidentiality, integrity, and availability of the WordPress instance.

Critical Impact

Attackers can trick authenticated WordPress administrators into executing unintended actions through the MDTF plugin, potentially compromising site configuration and content.

Affected Products

• realmag777 WordPress Meta Data and Taxonomies Filter (MDTF)
• Plugin versions from n/a through 1.3.3.1
• WordPress sites with MDTF installed and an authenticated administrator session

Discovery Timeline

• 2024-03-29 - CVE-2024-30457 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-30457

Vulnerability Analysis

The MDTF plugin exposes administrative actions without sufficient request origin verification. CSRF protections such as WordPress nonces (wp_nonce_field, check_admin_referer, or wp_verify_nonce) are missing or improperly validated on sensitive endpoints. This allows a remote attacker to forge requests that the server processes as legitimate administrator actions.

The attack requires the victim to be logged in to WordPress with privileges that the MDTF plugin honors. The attacker then induces the victim to visit a crafted page or click a malicious link. The browser automatically includes the victim's authentication cookies, and the forged request executes with the victim's privileges.

The attack vector is network-based and the attack complexity is low, but user interaction is required. The vulnerability can be chained with stored configuration changes to escalate impact, including persistent modification of plugin behavior or injection of attacker-controlled content.

Root Cause

The root cause is the absence or incorrect implementation of CSRF tokens on state-changing requests handled by the plugin. WordPress provides the nonce API specifically to prevent this class of attack, and the affected MDTF endpoints fail to validate these tokens before performing privileged actions.

Attack Vector

Exploitation occurs over the network and requires the targeted administrator to interact with attacker-controlled content. An attacker hosts a malicious page containing an auto-submitting form or image tag that targets the vulnerable MDTF endpoint. When the authenticated administrator loads the page, the forged request is delivered to the WordPress site with the administrator's cookies attached.

The vulnerability is described in prose because no verified public proof-of-concept code has been published. Refer to the Patchstack CSRF Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-30457

Indicators of Compromise

• Unexpected modifications to MDTF plugin settings or filter taxonomies without a corresponding audit trail
• HTTP requests to WordPress admin endpoints originating with Referer headers from untrusted external domains
• Administrator-initiated changes occurring shortly after the user visited an external link or email
• Creation or modification of plugin-controlled metadata that administrators did not initiate

Detection Strategies

• Inspect WordPress access logs for POST requests to MDTF plugin endpoints that lack a valid _wpnonce parameter
• Correlate browser session activity with administrative changes to identify forged requests
• Monitor for cross-origin Referer values targeting /wp-admin/admin.php or plugin-specific URLs
• Compare current plugin configuration against a known-good baseline at regular intervals

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized analytics platform for retention and correlation
• Alert on administrative actions performed outside expected change windows
• Enable WordPress audit logging plugins to capture user, IP, and action metadata for every privileged operation
• Track plugin version inventory across WordPress installations to confirm patch status

How to Mitigate CVE-2024-30457

Immediate Actions Required

• Update the MDTF plugin to a version released after 1.3.3.1 that includes a fix for CVE-2024-30457
• If no fixed version is available, deactivate and remove the MDTF plugin until a patch is released
• Force re-authentication for all WordPress administrators and rotate session keys in wp-config.php
• Review plugin and site configuration for unauthorized changes made during the exposure window

Patch Information

Consult the Patchstack CSRF Vulnerability Report for the latest vendor remediation guidance. Administrators should verify the installed plugin version against the vendor's official release notes and apply the fixed release as soon as it is available.

Workarounds

• Restrict access to the WordPress admin interface using IP allowlists at the web server or WAF layer
• Require administrators to use separate browser profiles for WordPress administration to reduce cookie reuse
• Deploy a web application firewall rule that blocks POST requests to MDTF endpoints lacking a valid nonce parameter
• Enforce SameSite=Lax or SameSite=Strict cookie attributes on WordPress authentication cookies where compatible

# Example: disable the vulnerable plugin via WP-CLI until a patch is applied
wp plugin deactivate wp-meta-data-filter-and-taxonomy-filter
wp plugin delete wp-meta-data-filter-and-taxonomy-filter

# Verify removal
wp plugin list --status=active | grep -i mdtf