CVE-2024-35771 Overview
CVE-2024-35771 is a Cross-Site Request Forgery (CSRF) vulnerability in the Presscustomizr Customizr WordPress theme. The flaw affects all versions from n/a through 4.4.21. Attackers can trick authenticated users, including administrators, into submitting forged requests that trigger state-changing operations within the theme. The issue is tracked under CWE-352 and is documented in the Patchstack Customizr CSRF Vulnerability advisory.
Critical Impact
Successful exploitation allows attackers to perform unauthorized theme actions on behalf of authenticated WordPress users, potentially compromising confidentiality, integrity, and availability of the site.
Affected Products
- Presscustomizr Customizr WordPress theme (all versions up to and including 4.4.21)
- WordPress sites running the vulnerable theme
- Any site relying on Customizr theme handlers without CSRF protection
Discovery Timeline
- 2024-06-21 - CVE-2024-35771 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-35771
Vulnerability Analysis
The vulnerability stems from missing or improper CSRF protection in one or more request handlers exposed by the Customizr theme. WordPress themes typically guard state-changing actions with nonces validated through wp_verify_nonce() or check_admin_referer(). When these checks are absent or improperly implemented, the server accepts requests based solely on the victim's session cookie.
An attacker crafts a malicious page that issues a forged request to the target WordPress site. If a signed-in administrator visits the attacker-controlled page, the browser automatically attaches authentication cookies. The Customizr theme processes the request as if it originated from the legitimate user.
The impact ratings for confidentiality, integrity, and availability are all high, indicating the affected functionality can influence sensitive theme or site configuration. User interaction is required, which is consistent with typical CSRF exploitation flows.
Root Cause
The root cause is a failure to enforce anti-CSRF tokens on privileged actions handled by the theme. Under CWE-352, the application cannot verify that a request was intentionally submitted by the authenticated user. Without nonce validation or equivalent origin checks, the theme trusts any request bearing a valid session cookie.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a malicious HTML page containing an auto-submitting form or image tag targeting a vulnerable Customizr endpoint. The attacker delivers the link through phishing, forum posts, or a compromised site. When an authenticated WordPress administrator loads the page, the browser silently issues the forged request, and the theme executes the requested action.
No verified public proof-of-concept exploit is available for CVE-2024-35771. Refer to the Patchstack advisory for additional technical context.
Detection Methods for CVE-2024-35771
Indicators of Compromise
- Unexpected changes to Customizr theme settings or site configuration without corresponding administrator activity
- HTTP POST requests to WordPress admin endpoints with Referer headers pointing to external, untrusted domains
- Administrator sessions that generated state-changing requests immediately after visiting third-party links
- Absence of a valid _wpnonce parameter in requests hitting Customizr handlers
Detection Strategies
- Review web server access logs for POST requests to /wp-admin/ paths originating with external referers during administrator sessions
- Enable WordPress audit logging to capture option and theme setting changes with user attribution and source IP
- Compare the installed Customizr version against 4.4.21 and flag any instance at or below this version as vulnerable
Monitoring Recommendations
- Monitor authenticated administrator sessions for anomalous cross-origin request patterns
- Alert on modifications to wp_options entries associated with the Customizr theme outside scheduled maintenance windows
- Correlate outbound phishing indicators with subsequent administrative actions on WordPress hosts
How to Mitigate CVE-2024-35771
Immediate Actions Required
- Identify all WordPress instances running the Customizr theme and inventory their versions
- Update the Customizr theme to a version later than 4.4.21 where the vendor has addressed the CSRF issue
- Force logout of all administrator sessions and rotate credentials after patching
- Review recent theme and site configuration changes for unauthorized modifications
Patch Information
Upgrade the Customizr theme to a fixed release beyond 4.4.21. Consult the Patchstack Customizr CSRF Vulnerability entry for the latest fixed version and vendor guidance.
Workarounds
- Deploy a Web Application Firewall (WAF) rule to block requests to Customizr endpoints lacking a valid _wpnonce parameter or matching Origin/Referer header
- Restrict access to /wp-admin/ by IP allowlist where operationally feasible
- Require administrators to use separate browsers or containers when performing privileged WordPress actions
- Disable or replace the Customizr theme on production sites until a patched version is deployed
# Example WAF rule concept: block admin POSTs without matching Origin
# ModSecurity pseudo-rule
SecRule REQUEST_METHOD "@streq POST" \
"chain,phase:1,deny,status:403,id:1000352,msg:'CSRF: missing/invalid Origin for wp-admin'"
SecRule REQUEST_URI "@beginsWith /wp-admin/" "chain"
SecRule &REQUEST_HEADERS:Origin "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
