CVE-2024-32537 Overview
CVE-2024-32537 is a Cross-Site Request Forgery (CSRF) vulnerability in the Flash Video Player WordPress plugin by joshuae1974. The flaw affects all versions up to and including 5.0.4. According to the Patchstack advisory, the CSRF condition can be chained into a Cross-Site Scripting (XSS) outcome, expanding its impact beyond simple state changes. Exploitation requires user interaction such as clicking a crafted link while authenticated to the target WordPress site. The vulnerability is classified under [CWE-352] Cross-Site Request Forgery.
Critical Impact
An attacker can trick an authenticated administrator into submitting forged requests that lead to stored or reflected XSS in the WordPress admin context.
Affected Products
- joshuae1974 Flash Video Player WordPress plugin
- All versions from initial release through 5.0.4
- WordPress sites with the Flash Video Player plugin installed and active
Discovery Timeline
- 2026-03-20 - CVE-2024-32537 published to NVD
- 2026-04-22 - Last updated in NVD database
Technical Details for CVE-2024-32537
Vulnerability Analysis
The Flash Video Player plugin fails to validate the origin or authenticity of state-changing HTTP requests. Plugin endpoints that modify configuration or content do not enforce anti-CSRF tokens such as WordPress wp_nonce checks. An attacker who lures an authenticated user to a malicious page can cause the browser to issue requests against the WordPress site using the victim's session cookies. Because the affected endpoint also fails to sanitize input, the forged request can persist attacker-controlled script payloads, producing a CSRF-to-XSS chain. Once injected, the script executes in the context of any user viewing the affected page, including site administrators.
Root Cause
The plugin's request handlers do not verify nonces or referrer headers before processing input. They also lack output encoding and input sanitization on values reachable through those handlers. The combination of missing CSRF protection and missing XSS filtering produces the chained vulnerability described in the Patchstack advisory.
Attack Vector
Exploitation occurs over the network and requires user interaction. An attacker hosts a page containing a hidden form or fetch request targeting the vulnerable plugin endpoint. When an authenticated WordPress user, typically an administrator, visits the page, the browser submits the request with valid session cookies. The plugin processes the request without origin verification, persisting attacker-controlled JavaScript that executes on subsequent page loads.
No verified proof-of-concept code is published. Refer to the Patchstack WordPress Vulnerability Notice for technical details.
Detection Methods for CVE-2024-32537
Indicators of Compromise
- Unexpected <script> tags, event handlers, or javascript: URIs stored in Flash Video Player plugin settings or post content rendered by the plugin
- HTTP POST requests to plugin administrative endpoints with Referer headers pointing to external or unexpected domains
- New or modified WordPress administrator accounts created shortly after a user clicked an external link
- Outbound requests from admin browser sessions to attacker-controlled domains following plugin interactions
Detection Strategies
- Audit the plugin's stored configuration values and post metadata for injected HTML or JavaScript content
- Review WordPress access logs for state-changing requests to /wp-admin/ plugin endpoints lacking expected nonce parameters
- Correlate browser session activity from administrator accounts with external referrers in web server logs
Monitoring Recommendations
- Enable WordPress audit logging to capture plugin setting changes and option updates
- Monitor for anomalous administrator activity such as setting changes following inbound clicks from external domains
- Alert on script content appearing in fields that should contain only URLs, filenames, or plain text
How to Mitigate CVE-2024-32537
Immediate Actions Required
- Deactivate the Flash Video Player plugin until a patched release above version 5.0.4 is confirmed available
- Force re-authentication for all WordPress administrators and rotate session cookies
- Inspect plugin-managed content and settings for injected scripts and remove malicious payloads
- Restrict administrative access using IP allowlisting or VPN where feasible
Patch Information
No fixed version is identified in the available references. The Patchstack advisory lists the vulnerable range as up to and including 5.0.4. Site operators should monitor the Patchstack advisory and the plugin's WordPress.org page for an updated release that adds nonce verification and input sanitization.
Workarounds
- Remove or deactivate the Flash Video Player plugin if it is not essential
- Deploy a Web Application Firewall (WAF) rule that blocks POST requests to plugin endpoints lacking a valid WordPress nonce
- Enforce a strict Content Security Policy (CSP) that disallows inline scripts in the WordPress admin interface
- Require administrators to use a dedicated browser profile for WordPress administration to reduce CSRF exposure
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
