CVE-2024-35770: Davekiss Vimeography CSRF Vulnerability

CVE-2024-35770 Overview

CVE-2024-35770 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Vimeography: Vimeo Video Gallery WordPress plugin developed by Dave Kiss. The flaw affects all plugin versions up to and including 2.4.1. An attacker can trick an authenticated WordPress administrator into submitting a forged request that performs privileged plugin actions without consent.

Critical Impact
Successful exploitation allows attackers to perform state-changing actions in the plugin context on behalf of an authenticated administrator, potentially compromising gallery configuration, plugin settings, and site integrity.

Affected Products

Dave Kiss Vimeography: Vimeo Video Gallery WordPress Plugin versions up to and including 2.4.1
WordPress installations using the vimeography plugin
Sites where administrators browse external content while authenticated to WordPress

Discovery Timeline

2024-06-21 - CVE-2024-35770 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35770

Vulnerability Analysis

The vulnerability stems from missing or improper anti-CSRF token validation in privileged request handlers within the Vimeography plugin. WordPress provides nonce primitives such as wp_create_nonce() and check_admin_referer() to bind a request to the originating user session. When plugin endpoints accept administrative actions without verifying these nonces, any cross-origin request carrying the victim's session cookies is processed as legitimate.

An attacker hosts a malicious page or injects HTML into a third-party site. When a logged-in WordPress administrator visits that page, the browser automatically attaches authentication cookies to the forged request directed at the vulnerable plugin endpoint. The plugin then executes the action under the administrator's privileges.

The vulnerability requires user interaction, since the victim must visit attacker-controlled content while authenticated. The attack vector is network-based and exploitable without prior privileges on the target WordPress site.

Root Cause

The root cause is the absence of effective CSRF protection on state-changing endpoints exposed by the plugin. Affected handlers process incoming requests based on session authentication alone, without validating a per-request nonce or verifying the Origin and Referer headers.

Attack Vector

An attacker crafts an HTML form or JavaScript payload that submits a request to a vulnerable Vimeography endpoint on the target WordPress site. The attacker distributes a link to this content through phishing, forum posts, or compromised third-party sites. When an administrator clicks the link, the browser issues the cross-site request with valid session cookies and the plugin executes the action.

No synthetic exploit code is published here. Refer to the Patchstack CSRF Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-35770

Indicators of Compromise

Unexpected modifications to Vimeography gallery configurations or plugin settings without corresponding administrator activity in audit logs.
POST requests to plugin endpoints under /wp-admin/ containing Referer headers from external, untrusted domains.
Administrator session activity that correlates with browsing to suspicious external URLs immediately before configuration changes.

Detection Strategies

Inspect web server access logs for requests targeting vimeography plugin handlers where the Referer header is missing or originates outside the site domain.
Correlate WordPress audit log entries with HTTP request metadata to identify administrative actions lacking valid nonce parameters.
Deploy a Web Application Firewall (WAF) rule that flags cross-origin POST requests to /wp-admin/admin.php and /wp-admin/admin-ajax.php involving the plugin.

Monitoring Recommendations

Enable a WordPress audit logging plugin to record administrator actions, including the source IP and user agent for every state change.
Monitor for anomalous plugin configuration changes outside scheduled maintenance windows.
Alert on administrator logins from new browsers or geolocations that precede plugin setting modifications.

How to Mitigate CVE-2024-35770

Immediate Actions Required

Update the Vimeography plugin to a version newer than 2.4.1 once the vendor publishes a patched release.
If no patched version is available, deactivate and remove the plugin until a fix ships.
Audit recent plugin configuration changes and revert any unauthorized modifications.
Force a password reset and session invalidation for all WordPress administrator accounts.

Patch Information

At the time of NVD publication, the advisory referenced in the Patchstack CSRF Vulnerability Report lists all versions through 2.4.1 as affected. Verify the WordPress plugin directory for the latest release before re-enabling the plugin.

Workarounds

Restrict /wp-admin/ access to allowlisted IP addresses through web server or firewall rules.
Enforce SameSite cookie attributes on WordPress authentication cookies to limit cross-site cookie transmission.
Require administrators to use separate browsers or browser profiles dedicated to WordPress management.
Deploy a WAF rule that blocks POST requests to Vimeography endpoints when the Referer header does not match the site origin.

bash

# Example nginx rule to block cross-origin POSTs to the plugin endpoints
location ~ ^/wp-admin/(admin|admin-ajax)\.php$ {
    if ($request_method = POST) {
        set $csrf_block "0";
        if ($http_referer !~* "^https?://your-site\.example/") {
            set $csrf_block "1";
        }
        if ($csrf_block = "1") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}