CVE-2024-31932: Blocksy Companion CSRF Vulnerability

CVE-2024-31932 Overview

CVE-2024-31932 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the CreativeThemes Blocksy Companion plugin for WordPress. The flaw impacts all versions up to and including 2.0.28. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unauthorized state-changing requests against the target site. The vulnerability is categorized under CWE-352 and requires user interaction over the network. Successful exploitation can compromise the confidentiality, integrity, and availability of the affected WordPress installation.

Critical Impact

An attacker can trick an authenticated administrator into executing privileged plugin actions through a forged request, leading to site compromise.

Affected Products

• CreativeThemes Blocksy Companion plugin for WordPress
• All versions from initial release through 2.0.28
• WordPress sites running the Blocksy Companion plugin with administrative sessions

Discovery Timeline

• 2024-04-11 - CVE-2024-31932 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-31932

Vulnerability Analysis

The Blocksy Companion plugin exposes one or more state-changing endpoints that do not adequately verify the origin of incoming requests. The plugin fails to validate WordPress nonces or referrer headers on sensitive actions through version 2.0.28. An attacker who lures an authenticated administrator to a controlled page can issue forged requests using the victim's browser session.

The attack requires user interaction but no privileges of its own, since the victim's authenticated cookies authorize the action. Because the affected endpoints belong to a plugin commonly installed with administrative scope, the forged request can modify plugin settings or invoke privileged functionality. The result is a chained compromise that affects site integrity, confidentiality, and availability.

Root Cause

The root cause is missing or insufficient CSRF protection on plugin request handlers. WordPress provides the wp_nonce_field() and check_admin_referer() APIs for this purpose. The vulnerable code paths in Blocksy Companion through 2.0.28 either omit nonce verification or rely on tokens that an attacker can predict or replay. This allows cross-origin requests to be processed as if they originated from a legitimate administrative session.

Attack Vector

Exploitation proceeds over the network and requires the victim to click a link, visit a malicious site, or load attacker-controlled content while authenticated to WordPress. The attacker crafts an HTML form or JavaScript request that targets the vulnerable plugin endpoint. The victim's browser automatically attaches the WordPress session cookie, and the server executes the action. No authentication credentials need to be stolen for the attack to succeed. See the Patchstack Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2024-31932

Indicators of Compromise

• Unexpected modifications to Blocksy Companion plugin settings without corresponding administrator activity in audit logs
• POST requests to plugin endpoints with Referer headers pointing to external or unknown domains
• Administrator session activity originating from unusual IP addresses immediately after visiting third-party links
• New or modified WordPress options, widgets, or content blocks created outside normal change windows

Detection Strategies

• Inspect WordPress access logs for POST requests to Blocksy Companion handlers that lack a valid Referer matching the site origin
• Compare plugin configuration snapshots before and after suspected events to identify unauthorized changes
• Correlate administrator browser activity with state-changing requests to detect off-session modifications
• Deploy a Web Application Firewall (WAF) rule that blocks cross-origin POST requests to administrative endpoints

Monitoring Recommendations

• Enable WordPress audit logging to capture plugin setting changes, user role modifications, and option updates
• Monitor administrative accounts for concurrent or geographically inconsistent sessions
• Forward web server and WordPress logs to a centralized SIEM for correlation and alerting on anomalies

How to Mitigate CVE-2024-31932

Immediate Actions Required

• Update Blocksy Companion to a version later than 2.0.28 that includes the CSRF fix
• Audit administrator accounts and rotate passwords if suspicious activity is observed
• Review plugin settings and recent content changes for unauthorized modifications
• Restrict administrative access to trusted networks where feasible

Patch Information

CreativeThemes addressed the vulnerability in a release after Blocksy Companion 2.0.28. Site operators should upgrade to the latest available version via the WordPress plugin updater. Refer to the Patchstack Vulnerability Advisory for the fixed version and advisory details.

Workarounds

• Deactivate the Blocksy Companion plugin until the patched version is installed
• Require administrators to log out of WordPress before browsing untrusted sites
• Deploy a WAF rule that enforces same-origin Referer validation on wp-admin and plugin AJAX endpoints
• Enforce SameSite=Strict cookies on the WordPress session cookie to limit cross-site request inclusion

# Configuration example: enforce SameSite cookies and verify Referer at the web server
# nginx snippet to block cross-origin POSTs to wp-admin
map $http_referer $blocked_csrf {
    default 1;
    "~^https://example\.com/" 0;
}

server {
    location ~ ^/wp-admin/admin-ajax\.php$ {
        if ($request_method = POST) {
            if ($blocked_csrf) { return 403; }
        }
    }
}