CVE-2024-35648: Emergency Password Reset CSRF Vulnerability

CVE-2024-35648 Overview

CVE-2024-35648 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Andy Moyle Emergency Password Reset plugin for WordPress. The flaw impacts all plugin versions up to and including 8.0. An attacker can craft a malicious web page that, when visited by an authenticated WordPress administrator, triggers unauthorized state-changing actions through the plugin. The vulnerability is classified under [CWE-352] and carries a CVSS 3.1 base score of 4.3. Exploitation requires user interaction but no privileges on the target site, making social engineering the primary delivery method.

Critical Impact
An attacker can abuse the Emergency Password Reset plugin to trigger password reset actions on behalf of an authenticated administrator, leading to integrity impact on WordPress user accounts.

Affected Products

Andy Moyle Emergency Password Reset plugin for WordPress
All versions from n/a through 8.0
WordPress sites with the plugin installed and activated

Discovery Timeline

2026-06-17 - CVE-2024-35648 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35648

Vulnerability Analysis

The Emergency Password Reset plugin fails to validate the origin of state-changing HTTP requests. The plugin's administrative actions do not verify a WordPress nonce or equivalent anti-CSRF token before processing requests. As a result, a browser session belonging to a logged-in administrator will automatically attach valid authentication cookies to requests originating from attacker-controlled pages.

The issue exists in the request handling layer of the plugin. When an administrator visits a malicious site while authenticated to WordPress, the attacker's page can submit forms or issue requests to the plugin's endpoints. The plugin processes these requests as if they were legitimate administrator actions.

According to the EPSS model, the probability of exploitation in the next 30 days is 0.127% (2.66 percentile), reflecting the user interaction requirement.

Root Cause

The root cause is missing CSRF protection on sensitive plugin operations. The plugin does not call wp_verify_nonce() or check_admin_referer() on its request handlers. WordPress provides nonce APIs specifically to mitigate this class of attack, but the affected versions of Emergency Password Reset do not enforce them on emergency reset workflows.

Attack Vector

Exploitation requires an attacker to convince an authenticated WordPress administrator to load attacker-controlled content. This is typically delivered through phishing emails, malicious advertisements, or compromised third-party sites. Upon page load, embedded HTML or JavaScript issues a forged request to the vulnerable plugin endpoint. Because the browser sends the administrator's session cookie automatically, WordPress treats the request as authentic and the plugin processes the unauthorized action.

No verified public proof-of-concept code is available. For technical details, see the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-35648

Indicators of Compromise

Unexpected password reset events for WordPress administrator or user accounts recorded in the site's audit log.
HTTP POST or GET requests to Emergency Password Reset plugin endpoints containing Referer headers that point to external, untrusted domains.
Administrator account lockouts or login failures following a successful CSRF-driven password reset.

Detection Strategies

Inspect WordPress access logs for requests to plugin URLs that originate from cross-origin referers or have missing nonce parameters.
Correlate browser activity logs with WordPress administrative events to identify password resets triggered shortly after an administrator visited an external site.
Hunt for newly modified user credentials in the wp_users table that lack a corresponding legitimate password reset request.

Monitoring Recommendations

Enable a WordPress security audit plugin to log all user account modifications, including password and email changes.
Forward WordPress and web server logs to a centralized SIEM for correlation with browser proxy telemetry.
Alert on any administrator-level account modification that occurs without a preceding interactive login from a known administrative workstation.

How to Mitigate CVE-2024-35648

Immediate Actions Required

Disable the Emergency Password Reset plugin until a patched version is confirmed available.
Force a password rotation for all administrator-level accounts on affected WordPress sites.
Restrict administrative access to the WordPress dashboard using IP allowlisting at the web server or WAF layer.
Train administrators not to browse untrusted sites while authenticated to the WordPress admin console.

Patch Information

The NVD entry indicates the vulnerability affects Emergency Password Reset versions up to and including 8.0. Site owners should consult the Patchstack Vulnerability Report and the plugin vendor for an updated release. If no fixed version is available, replace the plugin with a maintained alternative.

Workarounds

Deploy a web application firewall rule that blocks requests to the plugin's endpoints when the Referer header does not match the site's own domain.
Configure the SameSite=Strict attribute on WordPress session cookies to prevent cross-site cookie attachment.
Use a dedicated administrative browser profile that is not used for general web browsing.
Limit administrator session lifetime and require re-authentication for sensitive actions.

bash

# Example WAF rule (ModSecurity) to block cross-origin POSTs to the plugin
SecRule REQUEST_URI "@contains /wp-admin/admin.php?page=emergency-password-reset" \
    "chain,phase:2,deny,status:403,id:1009001,msg:'CVE-2024-35648 CSRF block'"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example.com" "t:none"