CVE-2024-32537: Flash Video Player CSRF Vulnerability

CVE-2024-32537 Overview

CVE-2024-32537 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Flash Video Player WordPress plugin developed by joshuae1974. This vulnerability allows attackers to trick authenticated administrators into performing unintended actions, potentially leading to Cross-Site Scripting (XSS) attacks. The vulnerability exists in all versions of the plugin from initial release through version 5.0.4.

Critical Impact

Attackers can exploit this CSRF vulnerability to chain attacks, potentially leading to stored XSS, unauthorized configuration changes, and compromise of WordPress administrator sessions.

Affected Products

• Flash Video Player WordPress Plugin (versions through 5.0.4)
• WordPress installations with Flash Video Player plugin enabled
• Sites allowing authenticated administrator access

Discovery Timeline

• 2026-03-20 - CVE-2024-32537 published to NVD
• 2026-03-20 - Last updated in NVD database

Technical Details for CVE-2024-32537

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery), indicating that the Flash Video Player plugin fails to properly validate request origins for sensitive operations. The vulnerability enables attackers to craft malicious requests that, when executed by an authenticated administrator, perform unauthorized actions within the plugin's administrative interface.

The attack requires user interaction, specifically that an authenticated administrator must visit a malicious page or click a crafted link while logged into their WordPress dashboard. The vulnerability has a changed scope, meaning successful exploitation can affect resources beyond the vulnerable component, leading to confidentiality, integrity, and availability impacts on the WordPress installation.

Root Cause

The root cause of this vulnerability lies in the absence of proper CSRF token validation (nonce verification) within the Flash Video Player plugin's administrative functions. WordPress provides built-in nonce functionality through wp_nonce_field() and wp_verify_nonce() functions, but the vulnerable plugin versions fail to implement these security controls correctly on one or more administrative endpoints.

Without CSRF protection, the plugin cannot distinguish between legitimate administrator requests and forged requests originating from malicious third-party websites.

Attack Vector

The attack vector for CVE-2024-32537 is network-based, requiring no prior privileges on the target system. An attacker would typically:

1. Craft a malicious HTML page containing a hidden form or JavaScript that submits requests to the vulnerable plugin endpoint
2. Trick an authenticated WordPress administrator into visiting the malicious page
3. The victim's browser automatically includes session cookies with the forged request
4. The plugin processes the malicious request as if it were a legitimate administrative action

According to Patchstack's vulnerability report, this CSRF vulnerability can be chained with XSS, allowing attackers to inject malicious scripts that persist within the plugin's configuration. This CSRF-to-XSS chain significantly increases the impact, as the injected scripts execute whenever administrators access affected plugin pages.

Detection Methods for CVE-2024-32537

Indicators of Compromise

• Unexpected changes to Flash Video Player plugin settings without administrator action
• Modified plugin configuration values containing suspicious JavaScript or HTML content
• WordPress audit logs showing administrative actions from unusual IP addresses or at unexpected times
• Browser console errors indicating blocked cross-origin requests to the WordPress admin panel

Detection Strategies

• Enable WordPress audit logging to track all administrative plugin configuration changes
• Implement Content Security Policy (CSP) headers to detect and block unauthorized script execution
• Monitor HTTP Referer headers for administrative requests originating from external domains
• Deploy Web Application Firewall (WAF) rules to detect CSRF attack patterns targeting WordPress plugins

Monitoring Recommendations

• Configure real-time alerts for plugin configuration modifications in WordPress
• Review server access logs for POST requests to the Flash Video Player plugin endpoints from suspicious referrers
• Implement SentinelOne Singularity XDR for endpoint-level detection of malicious browser activity and script injection attempts
• Monitor for new or modified JavaScript files within the plugin directory

How to Mitigate CVE-2024-32537

Immediate Actions Required

• Audit Flash Video Player plugin settings for any unauthorized modifications or injected content
• Consider temporarily disabling the Flash Video Player plugin until a patched version is available
• Implement Web Application Firewall rules to block suspicious POST requests to WordPress admin endpoints
• Educate administrators about phishing risks and the importance of verifying URLs before clicking links
• Review WordPress user accounts and remove any unauthorized administrator accounts

Patch Information

Organizations should monitor the Patchstack vulnerability database for updates regarding patches for this vulnerability. Users running Flash Video Player version 5.0.4 or earlier should check for plugin updates through the WordPress admin dashboard and apply any available security updates immediately.

If no patch is available, consider migrating to an alternative video player plugin that is actively maintained and implements proper CSRF protections.

Workarounds

• Restrict WordPress admin access to trusted IP addresses using .htaccess rules or security plugins
• Implement additional authentication layers such as two-factor authentication for WordPress administrators
• Use browser extensions that warn about or block cross-site request submissions
• Configure HTTP security headers including SameSite cookie attributes to limit cross-site request risks
• Deploy the SentinelOne WordPress protection module to detect and block exploitation attempts at the endpoint level

# Example .htaccess configuration to restrict wp-admin access by IP
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.100$
RewriteCond %{REMOTE_ADDR} !^10\.0\.0\.50$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>