CVE-2024-34807: Fast Custom Social Share CSRF Vulnerability

CVE-2024-34807 Overview

CVE-2024-34807 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the CodeBard Fast Custom Social Share plugin for WordPress. The flaw impacts all plugin versions up to and including 1.1.2. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, triggers unauthorized state-changing actions in the plugin without the user's consent. Exploitation requires user interaction, such as clicking a link or loading attacker-controlled content, but no attacker authentication to the target site is needed. The issue is tracked by Patchstack's CSRF vulnerability report.

Critical Impact
An attacker can trick an authenticated WordPress administrator into performing unintended plugin configuration changes, resulting in limited integrity impact on the affected site.

Affected Products

CodeBard Fast Custom Social Share plugin for WordPress
Versions from n/a through 1.1.2
WordPress sites with the fast-custom-social-share-by-codebard plugin installed and active

Discovery Timeline

2024-05-17 - CVE-2024-34807 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34807

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery weakness in the Fast Custom Social Share by CodeBard WordPress plugin. The plugin fails to enforce a valid anti-CSRF token (WordPress nonce) on one or more state-changing request handlers. An unauthenticated remote attacker can craft an HTML page containing a forged request targeting the vulnerable endpoint. When an authenticated privileged user, typically an administrator, loads the attacker page, the browser submits the forged request using the victim's active session. The plugin processes the request as if it originated from the legitimate user. Impact is limited to integrity: confidentiality and availability are not directly affected, and the attacker cannot read plugin data or take the site offline through this flaw alone. See the Patchstack advisory for additional context.

Root Cause

The root cause is missing or improperly validated CSRF protection on plugin actions. WordPress provides the wp_nonce_field() and check_admin_referer() primitives to bind requests to a specific user session, and the affected plugin versions do not correctly apply these controls to sensitive handlers.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a malicious page, sends a phishing link, or embeds a hidden form on an attacker-controlled site. When a signed-in WordPress user with permissions on the plugin visits the page, the browser automatically attaches the WordPress session cookie to the forged POST or GET request, causing the plugin to execute the attacker-supplied action.

No verified public proof-of-concept code is available for this issue. Refer to the Patchstack advisory linked above for further technical details.

Detection Methods for CVE-2024-34807

Indicators of Compromise

Unexpected modifications to Fast Custom Social Share plugin settings that do not correspond to legitimate administrator activity.
WordPress access logs showing POST requests to plugin endpoints with Referer headers pointing to external, untrusted domains.
Administrator sessions submitting plugin configuration requests immediately after clicking external links or emails.

Detection Strategies

Review web server logs for state-changing requests to the plugin's admin handlers that lack a valid _wpnonce parameter or carry a cross-origin Referer.
Compare current plugin configuration against a known-good baseline to identify unauthorized changes.
Correlate WordPress wp_users login events with subsequent plugin setting modifications to spot suspicious sequences.

Monitoring Recommendations

Enable WordPress audit logging to track administrator actions and plugin option changes.
Alert on HTTP requests to /wp-admin/admin.php and /wp-admin/admin-post.php that include Referer headers from domains outside the site's own origin.
Monitor for repeated access attempts to plugin endpoints from newly seen client IP addresses.

How to Mitigate CVE-2024-34807

Immediate Actions Required

Identify all WordPress installations running the CodeBard Fast Custom Social Share plugin at version 1.1.2 or earlier.
Deactivate the plugin on affected sites until a patched release is installed if an upgrade is not immediately possible.
Advise administrators to log out of WordPress before browsing untrusted sites and to use a dedicated browser profile for admin activity.

Patch Information

At the time of publication, the Patchstack advisory lists the vulnerability as affecting versions up to and including 1.1.2. Site owners should upgrade to the latest release available from the WordPress plugin repository and verify that the version installed is greater than 1.1.2.

Workarounds

Restrict WordPress admin access to trusted IP ranges via web server or firewall rules to reduce the attack surface for CSRF payloads.
Deploy a web application firewall rule that blocks requests to the plugin's admin endpoints when the Referer header is missing or does not match the site's own origin.
Enforce short administrator session lifetimes and require re-authentication for sensitive plugin configuration changes.

bash

# Example Nginx configuration to enforce same-origin Referer on WordPress admin POST requests
location ~ ^/wp-admin/ {
    if ($request_method = POST) {
        set $csrf_block "1";
        if ($http_referer ~* "^https?://your-site\.example/") {
            set $csrf_block "0";
        }
        if ($csrf_block = "1") {
            return 403;
        }
    }
}