CVE-2024-35684: 10up ElasticPress CSRF Vulnerability

CVE-2024-35684 Overview

CVE-2024-35684 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the 10up ElasticPress plugin for WordPress. The flaw impacts all plugin versions up to and including 5.1.1. An attacker can craft a malicious web page that, when visited by an authenticated ElasticPress user, triggers unintended state-changing actions in the plugin. Successful exploitation requires user interaction but no privileges on the target site.

Critical Impact
An attacker can trick an authenticated WordPress administrator into submitting forged requests that modify ElasticPress plugin state, potentially disrupting search functionality.

Affected Products

10up ElasticPress plugin for WordPress
ElasticPress versions from n/a through 5.1.1
WordPress sites using ElasticPress for Elasticsearch integration

Discovery Timeline

2024-06-08 - CVE-2024-35684 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35684

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery weakness in the ElasticPress WordPress plugin. ElasticPress integrates WordPress with Elasticsearch to enhance search and query performance. The plugin exposes administrative endpoints that fail to validate the authenticity of incoming state-changing requests. An attacker who can lure an authenticated ElasticPress user to a crafted page can cause the browser to submit requests to the plugin on the user's behalf.

The impact is limited to integrity (partial), with no direct confidentiality or availability loss described by the advisory. Exploitation requires the victim to be authenticated and to interact with attacker-controlled content, such as clicking a link or loading a hostile page.

Root Cause

The root cause is missing or insufficient CSRF protection on plugin request handlers. WordPress plugins typically defend against CSRF using nonces generated with wp_create_nonce() and validated with check_admin_referer() or wp_verify_nonce(). In the affected ElasticPress versions, one or more administrative actions do not verify a valid nonce or origin before executing sensitive operations, allowing forged cross-origin requests to succeed. See the Patchstack ElasticPress CSRF Advisory for advisory details.

Attack Vector

The attack is delivered over the network via the victim's browser session. The attacker hosts a page containing an auto-submitting form or image tag that targets a vulnerable ElasticPress endpoint on the victim's WordPress site. When an authenticated administrator loads the attacker's page, the browser attaches WordPress session cookies to the outbound request. The plugin processes the request as if it were legitimate. No credentials are stolen; the attacker abuses the victim's active session to change plugin configuration or trigger plugin actions.

No public proof-of-concept exploit or CISA KEV listing exists for this issue at the time of writing.

Detection Methods for CVE-2024-35684

Indicators of Compromise

Unexpected changes to ElasticPress plugin settings, index configuration, or feature toggles in the WordPress admin interface
WordPress access logs showing POST requests to ElasticPress admin endpoints with Referer headers pointing to external, unrelated domains
Administrator activity records showing configuration changes at times the user was not actively working in the plugin

Detection Strategies

Review web server access logs for requests to /wp-admin/admin.php?page=elasticpress and related endpoints originating from off-site referrers
Audit WordPress activity logs for ElasticPress configuration changes not tied to a legitimate admin session
Compare current plugin settings and Elasticsearch index mappings against a known-good baseline to detect unauthorized modification

Monitoring Recommendations

Enable a WordPress audit-logging plugin to record all administrative setting changes with user, timestamp, and source IP
Alert on HTTP requests to ElasticPress admin endpoints where the Referer header does not match the site's own domain
Monitor Elasticsearch cluster activity for unexpected re-index operations or mapping changes that could correlate with forged requests

How to Mitigate CVE-2024-35684

Immediate Actions Required

Update the ElasticPress plugin to a version later than 5.1.1 as soon as a fixed release is available from 10up
Instruct WordPress administrators to log out of the admin panel when not actively using it to shrink the CSRF exposure window
Restrict /wp-admin/ access by IP allowlist at the web server or WAF layer where operationally feasible

Patch Information

Refer to the Patchstack ElasticPress CSRF Vulnerability entry for the current fixed version and vendor guidance. Apply the update through the WordPress plugin manager or via WP-CLI. Verify the installed version after upgrade and confirm the plugin loads without configuration errors.

Workarounds

Deploy a web application firewall rule that blocks state-changing requests to ElasticPress admin endpoints when the Referer or Origin header does not match the site's domain
Enforce SameSite=Lax or SameSite=Strict on the WordPress authentication cookies to reduce cross-site request risk
Limit ElasticPress administrative capabilities to a minimal set of trusted accounts and require re-authentication for sensitive actions

bash

# Example WP-CLI commands to update ElasticPress and audit installed version
wp plugin update elasticpress
wp plugin get elasticpress --field=version
wp user list --role=administrator --fields=ID,user_login,user_email