CVE-2024-32102: Crony Cronjob Manager CSRF Vulnerability

CVE-2024-32102 Overview

CVE-2024-32102 is a Cross-Site Request Forgery (CSRF) vulnerability in the Scott Kingsley Clark Crony Cronjob Manager plugin for WordPress. The flaw affects all versions of the plugin from initial release through version 0.5.0. An attacker can craft a malicious web page or link that, when visited by an authenticated administrator, triggers unintended state-changing actions in the target WordPress site. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery and requires user interaction to succeed.

Critical Impact
Successful exploitation allows attackers to abuse an authenticated user's session to modify cron job configurations in WordPress without their consent, potentially chaining into further site tampering.

Affected Products

Scott Kingsley Clark Crony Cronjob Manager (WordPress plugin)
Versions from initial release through 0.5.0
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2024-04-15 - CVE-2024-32102 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32102

Vulnerability Analysis

The Crony Cronjob Manager plugin fails to validate the origin of state-changing HTTP requests. Actions handled by the plugin do not enforce anti-CSRF tokens such as WordPress nonces verified through wp_verify_nonce() or the check_admin_referer() helper. Because the browser automatically attaches session cookies to outbound requests, a logged-in administrator visiting an attacker-controlled page can silently issue requests that the plugin treats as authorized.

The attack requires user interaction, and the impact is limited to integrity of plugin-managed data. Confidentiality and availability of the WordPress site are not directly affected by the flaw itself, though downstream abuse of cron manipulation may extend impact. The EPSS score reflects a low observed probability of exploitation in the wild.

Root Cause

The root cause is missing CSRF protection on request handlers that create, modify, or delete cron job entries. The plugin relies solely on WordPress authentication and capability checks, which do not defend against forged cross-origin requests. Without a per-request nonce tied to the user session, the server cannot distinguish between a legitimate admin action and one issued from an attacker's page.

Attack Vector

An attacker hosts a page containing a hidden HTML form or JavaScript that submits a POST request to the vulnerable plugin endpoint on a target WordPress site. The attacker then lures a logged-in administrator to visit the page through phishing or a malicious link. When the victim's browser sends the request, WordPress attaches the valid session cookie and the plugin processes the forged action. See the Patchstack CSRF Vulnerability Report for further technical detail.

No verified public exploit code is available for this vulnerability.

Detection Methods for CVE-2024-32102

Indicators of Compromise

Unexpected creation, modification, or deletion of scheduled cron jobs managed by the Crony plugin.
HTTP POST requests to Crony administrative endpoints with Referer headers pointing to external or unrelated domains.
Administrator account activity in web server logs that does not correlate with a genuine admin session in the WordPress dashboard.

Detection Strategies

Review WordPress activity logs for cron job changes that lack a corresponding user-initiated workflow.
Inspect web server access logs for state-changing requests to plugin URLs that arrive without a same-origin Referer or Origin header.
Correlate administrator browser history and email gateway logs with suspicious cron modifications to identify phishing-driven CSRF attempts.

Monitoring Recommendations

Enable an activity log plugin that captures administrator actions and cron configuration changes.
Alert on outbound requests initiated by cron entries that reference unfamiliar domains or IP addresses.
Monitor for new PHP files or scheduled tasks appearing after the vulnerable plugin is used.

How to Mitigate CVE-2024-32102

Immediate Actions Required

Identify all WordPress sites running the Crony Cronjob Manager plugin at version 0.5.0 or earlier.
Deactivate and remove the plugin if a patched release is not available for your environment.
Audit existing cron jobs and remove any entries that cannot be attributed to a legitimate administrator action.

Patch Information

At the time of NVD publication, the advisory identifies the plugin as vulnerable from initial release through 0.5.0. Consult the Patchstack advisory for the current fix status and any vendor-supplied update. If no fixed version is offered, replace the plugin with a maintained alternative.

Workarounds

Restrict access to the WordPress admin area using IP allowlisting or a web application firewall rule.
Require administrators to use a dedicated browser profile for WordPress management to limit cross-site cookie exposure.
Deploy a WAF rule that blocks POST requests to Crony plugin endpoints when the Origin or Referer header does not match the site's own domain.

bash

# Example Apache configuration to enforce same-origin on plugin endpoints
<LocationMatch "/wp-admin/admin\.php\?page=crony">
    SetEnvIfNoCase Referer "^https://your-site\.example/" allowed_ref
    Require env allowed_ref
</LocationMatch>