CVE-2024-3475 Overview
CVE-2024-3475 affects the Sticky Buttons WordPress plugin developed by Wow-Company in versions before 3.2.4. The plugin fails to implement Cross-Site Request Forgery (CSRF) protections on several bulk action endpoints. An attacker can craft a malicious page that, when visited by an authenticated administrator, triggers unwanted state-changing actions such as deleting buttons managed by the plugin. The issue is classified under CWE-352 Cross-Site Request Forgery.
Critical Impact
A logged-in administrator visiting an attacker-controlled page can be forced to delete Sticky Buttons plugin data without their consent.
Affected Products
- Wow-Company Sticky Buttons WordPress plugin versions prior to 3.2.4
- WordPress sites running the vulnerable plugin with administrator sessions active
- Any deployment where bulk actions in the plugin are exposed to authenticated admin users
Discovery Timeline
- 2024-05-02 - CVE-2024-3475 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-3475
Vulnerability Analysis
The Sticky Buttons plugin exposes bulk action handlers that modify server-side state, including the deletion of buttons. These handlers process requests from authenticated administrator sessions without verifying a WordPress nonce or equivalent anti-CSRF token. Because WordPress relies on session cookies for authentication, any request originating from an admin's browser inherits full privileges. An attacker who can lure an administrator to a crafted page can issue forged requests that the plugin accepts as legitimate.
The vulnerability requires user interaction, since an admin must load or interact with the attacker's page while logged into the WordPress site. Exploitation does not require attacker credentials on the target site. The scope changes because a successful CSRF attack traverses the browser trust boundary to affect the WordPress backend.
Root Cause
The root cause is a missing CSRF token check in bulk action processing routines within the plugin. WordPress provides wp_nonce_field() and check_admin_referer() primitives for exactly this purpose, but the affected code paths omit these calls. Without the nonce validation, the plugin cannot distinguish between an intentional admin action and a forged cross-origin request.
Attack Vector
An attacker hosts a page containing a hidden form or JavaScript that auto-submits a POST request to the vulnerable Sticky Buttons bulk action endpoint. The attacker sends the URL to a target administrator via phishing, forum posts, or comment sections. When the admin loads the page while authenticated to the WordPress site, the browser attaches the session cookie and the plugin executes the bulk action, such as deleting all configured buttons. See the WPScan Vulnerability Advisory for advisory details.
Detection Methods for CVE-2024-3475
Indicators of Compromise
- Unexpected deletion of buttons or configuration entries in the Sticky Buttons plugin without a corresponding admin action in access logs
- WordPress access log entries showing POST requests to Sticky Buttons bulk action endpoints with Referer headers pointing to external domains
- Admin-area actions recorded shortly after an administrator visited an external link received via email or messaging
Detection Strategies
- Review web server access logs for POST requests to wp-admin pages associated with the Sticky Buttons plugin where the Referer header is missing or off-site
- Correlate plugin configuration changes with authenticated admin session activity to identify actions that lack a preceding legitimate navigation
- Deploy a Web Application Firewall (WAF) rule that flags state-changing plugin requests missing a valid WordPress nonce parameter
Monitoring Recommendations
- Enable WordPress audit logging to record plugin configuration changes, including bulk deletions, with timestamp and user attribution
- Monitor for anomalous administrator activity patterns, such as bulk deletions occurring outside normal maintenance windows
- Alert on outbound links clicked by administrator accounts that immediately precede backend configuration changes
How to Mitigate CVE-2024-3475
Immediate Actions Required
- Update the Sticky Buttons plugin to version 3.2.4 or later on all WordPress installations
- Audit existing Sticky Buttons configurations for unauthorized deletions or modifications and restore from backup if needed
- Require administrators to log out of WordPress sessions when not actively managing the site to reduce CSRF exposure
Patch Information
Wow-Company addressed the vulnerability in Sticky Buttons version 3.2.4 by adding CSRF nonce validation to the affected bulk action handlers. Site operators should install the update through the WordPress plugin dashboard or via WP-CLI. Refer to the WPScan Vulnerability Advisory for the fixed version reference.
Workarounds
- Deactivate the Sticky Buttons plugin until the patched version can be installed if immediate updating is not feasible
- Restrict administrator access to the WordPress admin panel using IP allowlisting at the web server or WAF layer
- Enforce browser isolation or separate admin browser profiles so administrators do not browse untrusted content while authenticated
# Update Sticky Buttons plugin via WP-CLI
wp plugin update sticky-buttons --version=3.2.4
# Verify installed version
wp plugin get sticky-buttons --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
